What would you like?
Add an npm private (non-publishable) package.json to allow managing and pinning npm dependencies used in GitHub Actions workflows.
Why is this needed?
Best practices for GitHub repos have evolved in the face of supply-chain attacks, and favor pinning dependencies instead of allowing latest or SemVer ranges.
Code-scanning alerts for the repo, report "Pinned-Dependencies" for three GitHub Actions .github/workflows:
Other
PR #2570 proposes to replace has replaced eclint with prettier. In this case, prettier would be added to the package.json instead of eclint.
What would you like?
Add an npm private (non-publishable) package.json to allow managing and pinning npm dependencies used in GitHub Actions workflows.
Why is this needed?
Best practices for GitHub repos have evolved in the face of supply-chain attacks, and favor pinning dependencies instead of allowing
latestor SemVer ranges.Code-scanning alerts for the repo, report "Pinned-Dependencies" for three GitHub Actions .github/workflows:
eclint.yml(deleted)Other
PR #2570
proposes to replacehas replacedeclintwithprettier. In this case,prettierwould be added to thepackage.jsoninstead ofeclint.