mirror of
https://github.com/docker/compose.git
synced 2026-07-12 03:04:43 +00:00
336f21f846
The pinned codeql-action/upload-sarif v2 (v2.28.1) falls in the vulnerable range of CVE-2025-24362 and the v2 line has no patched release, so bump to v3.36.3. Scope the release job to tag refs so its contents:write token is only minted when a release is actually created. In merge.yml, drop a dead conditional (workflow only triggers on push) and pass DOCKERDESKTOP_REPO to github-script via env rather than inline interpolation, as recommended against script injection. Signed-off-by: Guillaume Lours <glours@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| ci.yml | ||
| docs-upstream.yml | ||
| merge.yml | ||
| pr-review-trigger.yml | ||
| pr-review.yml | ||
| scorecards.yml | ||
| stale.yml | ||
| zizmor.yml | ||