From 205649bef47dba1aa34a60ad660e9955f674b0ab Mon Sep 17 00:00:00 2001 From: decentraland-bot <44584806+decentraland-bot@users.noreply.github.com> Date: Mon, 18 May 2026 14:01:28 +0000 Subject: [PATCH 1/3] ci: pin third-party GitHub Actions to commit SHAs --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 18f8ab7..4cce1d0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -23,7 +23,7 @@ jobs: node-version: 18.x - name: set package.json version - uses: menduz/oddish-action@master + uses: menduz/oddish-action@b08e312231a6f5bbe63618f6dcaf0a1e54527c49 # @master with: deterministic-snapshot: true only-update-versions: true @@ -42,7 +42,7 @@ jobs: run: make test - name: Publish - uses: menduz/oddish-action@master + uses: menduz/oddish-action@b08e312231a6f5bbe63618f6dcaf0a1e54527c49 # @master with: registry-url: 'https://registry.npmjs.org' access: public From f3a1334215fcb1e62f9ecb15cb3078db5b02fb12 Mon Sep 17 00:00:00 2001 From: decentraland-bot <44584806+decentraland-bot@users.noreply.github.com> Date: Mon, 18 May 2026 15:56:14 +0000 Subject: [PATCH 2/3] ci: switch to decentraland/oddish-action and update pin --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4cce1d0..9ead257 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -23,7 +23,7 @@ jobs: node-version: 18.x - name: set package.json version - uses: menduz/oddish-action@b08e312231a6f5bbe63618f6dcaf0a1e54527c49 # @master + uses: decentraland/oddish-action@914e7c59e93e708152aa703c50196740c0526c1d # @master with: deterministic-snapshot: true only-update-versions: true @@ -42,7 +42,7 @@ jobs: run: make test - name: Publish - uses: menduz/oddish-action@b08e312231a6f5bbe63618f6dcaf0a1e54527c49 # @master + uses: decentraland/oddish-action@914e7c59e93e708152aa703c50196740c0526c1d # @master with: registry-url: 'https://registry.npmjs.org' access: public From 7442adfd72ca3a51e0fd39c5a7d57ad3d026cc00 Mon Sep 17 00:00:00 2001 From: decentraland-bot <44584806+decentraland-bot@users.noreply.github.com> Date: Mon, 18 May 2026 16:44:49 +0000 Subject: [PATCH 3/3] ci: pin actions/checkout to v4.3.0 SHA --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9ead257..e201543 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,7 +15,7 @@ jobs: contents: read id-token: write steps: - - uses: actions/checkout@master + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # @v4.3.0 - name: Use Node.js 18.x uses: actions/setup-node@v1