mirror of
https://github.com/coder/coder.git
synced 2026-09-23 22:20:22 +08:00
Jakub Domeracki
b8e09d09b0
Action taken In response to an ongoing incident: https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/ > We've not been compromised due to a combination of pinning [GitHub Actions by commit SHA](https://github.com/coder/coder/blob/c8e58575e0ee44fad37b5f2ffe1ef0f220c3cf23/.github/workflows/security.yaml#L149) coupled with a [dependabot cooldown period](https://github.com/coder/coder/pull/21079)