🩹[Patch]: Workflow improvements (#106)
This release makes several updates to the project's GitHub workflows and configuration files, focusing on improving reliability, security, and maintainability. Key changes include pinning GitHub Action dependencies to specific commit hashes, updating workflow schedules and cooldowns, removing or replacing configuration files for release and linters, and updating references to scripts and modules for better consistency.
GitHub Actions and Workflow Improvements:
- All workflows now pin the
actions/checkoutand other GitHub Actions to specific commit SHAs for improved security and reproducibility, and setpersist-credentials: falseto enhance security. - Updated the linter workflow to use a specific version of
super-linter, and disabled certain validations for improved performance and compatibility.
Release Process Updates:
- Removed the old
Auto-Release.ymlworkflow and replaced it with a newRelease.ymlworkflow that uses a different release action and is triggered on pull requests affecting release-relevant files. - Deleted the
.github/release.ymlconfiguration for auto-generated release notes, centralizing release configuration in the workflow.
Configuration and Scheduling Changes:
- Changed the Dependabot update schedule from weekly to daily, and introduced a 7-day cooldown to avoid excessive update PRs.
- Removed the
.github/linters/.jscpd.jsonconfiguration file, likely because duplicate code detection is now disabled or managed elsewhere.
Script and Module Reference Updates:
- Updated references in
action.ymlto use specific commit SHAs for external modules and changed script paths fromscripts/main.ps1tosrc/main.ps1for consistency.