12c6538b06
Last security-audit run revealed 4 step-level errors hidden by
continue-on-error (the job reported pass but each fix is real):
1. OSV-Scanner curl 404 -> tar exit 2. v2.x ships a raw binary
(`osv-scanner_linux_amd64`), not a tarball. Drop tar -xzf,
curl -o the binary directly + chmod +x.
2. cargo audit `parse error: TOML parse error at line 5 col 8`
on RUSTSEC-2026-0073.md. cargo-audit 0.21 doesn't parse the
CVSS 4.0 schema used in 2026 advisories. Bump pin to ^0.22.
3. TruffleHog `flag 'no-update' cannot be repeated`. The
trufflesecurity/trufflehog action passes --no-update
internally already; remove our duplicate from extra_args.
4. cyclonedx-py `unrecognized arguments: --schema-version 1.6
--outfile ...`. cyclonedx-bom 4.x renamed to `--sv` for spec
version and `-o` for the output file.
Plus pin every remaining mutable-ref action to a 40-char SHA. The
new GHA pinning verifier flagged 4 third-party + 40 first-party
mutable refs; this commit pins all 44 to the latest SHA *within
the existing major version* (no auto-upgrades). Mappings:
actions/checkout @v4 -> 34e114876b... (v4.3.1)
actions/setup-node @v4 -> 49933ea528... (v4.4.0)
actions/setup-python @v5 -> a26af69be9... (v5.6.0)
actions/stale @v10 -> b5d41d4e1d... (v10.2.0)
actions/upload-artifact @v4 -> ea165f8d65... (v4.6.2)
actions/cache @v4 -> 0057852bfa... (v4.3.0)
swatinem/rust-cache @v2 -> 23869a5bd6... (v2.9.1)
dtolnay/rust-toolchain @stable-> 29eef336d9... (stable @ 2026-05-07)
44 pins applied across 11 workflow files. The pin verifier now
reports zero unpinned `uses:`. Dependabot's github-actions
ecosystem (already configured in .github/dependabot.yml) will
auto-bump these SHAs in weekly batches.
This closes the same attack class that hit litellm 1.82.7: an
attacker who hijacks a tag (as in the aquasecurity/trivy-action
March 2026 incident) cannot redirect our workflows because we no
longer follow tag refs.
37 lines
1.3 KiB
YAML
37 lines
1.3 KiB
YAML
name: 'Inactive Issue Pinger'
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '30 5 * * *' # Runs at 5:30 UTC every day
|
|
|
|
jobs:
|
|
stale:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
issues: write
|
|
|
|
steps:
|
|
- uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
|
|
with:
|
|
# The message to post on stale issues.
|
|
# This message will ping the issue author.
|
|
# Note: The stale bot action does not currently support a direct placeholder for the last commenter.
|
|
# As a workaround, this message encourages any participant to reply.
|
|
stale-issue-message: >
|
|
Is this issue still important to you?
|
|
Apologies in advance we might have missed this issue as well.
|
|
For faster response times, please post on our Reddit server - https://www.reddit.com/r/unsloth or our Discord - https://discord.com/invite/unsloth
|
|
|
|
# The number of days of inactivity before an issue is considered stale.
|
|
days-before-issue-stale: 9999
|
|
|
|
# Set to -1 to never close stale issues.
|
|
days-before-issue-close: -1
|
|
|
|
# A label to apply to stale issues.
|
|
stale-issue-label: 'inactive'
|
|
|
|
# The number of operations to perform per run to avoid rate limiting.
|
|
operations-per-run: 500
|
|
|
|
enable-statistics: false
|