What would you like?
Add an npm private (non-publishable) package.json to allow managing and pinning npm dependencies used in GitHub Actions workflows.
Why is this needed?
Best practices for GitHub repos have evolved in the face of supply-chain attacks, and favor pinning dependencies instead of allowing latest or SemVer ranges.
Code-scanning alerts for the repo, report "Pinned-Dependencies" for three GitHub Actions .github/workflows:
Other
PR #2570 proposes to replace eclint with prettier. In this case, prettier would be added to the package.json instead of eclint.
What would you like?
Add an npm private (non-publishable) package.json to allow managing and pinning npm dependencies used in GitHub Actions workflows.
Why is this needed?
Best practices for GitHub repos have evolved in the face of supply-chain attacks, and favor pinning dependencies instead of allowing
latestor SemVer ranges.Code-scanning alerts for the repo, report "Pinned-Dependencies" for three GitHub Actions .github/workflows:
Other
PR #2570 proposes to replace
eclintwithprettier. In this case,prettierwould be added to thepackage.jsoninstead ofeclint.