From 5e3788f45afc1ed707036d5fcbbb85dc415fb604 Mon Sep 17 00:00:00 2001 From: Sebastian Mendel Date: Mon, 3 Aug 2026 14:23:27 +0200 Subject: [PATCH] ci: track netresearch/.github reusables on @main again `security.yml` and `auto-merge-deps.yml` were SHA-pinned and carried a trailing `# main` comment, while the sibling callers in `docker-publish.yml`, `scorecard.yml` and `codeql.yml` already track main. Org-owned reusables are referenced by `@main` so an upstream fix reaches every consumer at once; SHA-pinning is for third-party actions. Signed-off-by: Sebastian Mendel --- .github/workflows/auto-merge-deps.yml | 2 +- .github/workflows/security.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/auto-merge-deps.yml b/.github/workflows/auto-merge-deps.yml index 3fc9cc7ea..ecfbe8dcb 100644 --- a/.github/workflows/auto-merge-deps.yml +++ b/.github/workflows/auto-merge-deps.yml @@ -10,4 +10,4 @@ jobs: permissions: contents: write pull-requests: write - uses: netresearch/.github/.github/workflows/auto-merge-deps.yml@53469ad0d1024265804184e214318b9895559cc9 # main + uses: netresearch/.github/.github/workflows/auto-merge-deps.yml@main diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 6cb1e9986..20fafd9c8 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -16,7 +16,7 @@ jobs: node-audit: permissions: contents: read - uses: netresearch/.github/.github/workflows/node-audit.yml@53469ad0d1024265804184e214318b9895559cc9 # main + uses: netresearch/.github/.github/workflows/node-audit.yml@main with: package-manager: npm audit-level: high