coreui / coreui-pro / 29621665200

95%

push

github

ci: pin GitHub Actions to full commit SHAs (#611)

Pin every action to an immutable 40-char commit SHA (with a version comment),
matching upstream Bootstrap. A mutable tag (`@v2`) lets the action's author —
or an attacker who compromises it — repoint it to malicious code that runs in
CI (cf. the tj-actions/changed-files attack); `coverallsapp` is highest-risk as
it receives GITHUB_TOKEN + checks:write. Dependabot's existing weekly grouped
github-actions updates maintain the SHAs going forward.

2826 of 3116 branches covered (90.69%)

Branch coverage included in aggregate %.

7233 of 7509 relevant lines covered (96.32%)

788.18 hits per line