crewAI

mirror of https://github.com/crewAIInc/crewAI.git synced 2026-07-01 13:18:10 +00:00

Author	SHA1	Message	Date
Matt Aitchison	179c20b352	ci: pin third-party actions to commit SHAs (#5869 ) Some checks failed CodeQL Advanced / Analyze (actions) (push) Has been cancelled Details CodeQL Advanced / Analyze (python) (push) Has been cancelled Details Vulnerability Scan / pip-audit (push) Has been cancelled Details Check Documentation Broken Links / Check broken links (push) Has been cancelled Details Nightly Canary Release / Check for new commits (push) Has been cancelled Details Nightly Canary Release / Build nightly packages (push) Has been cancelled Details Nightly Canary Release / Publish nightly to PyPI (push) Has been cancelled Details Mark stale issues and pull requests / stale (push) Has been cancelled Details * ci: pin third-party actions to commit SHAs Pin third-party GitHub Actions in workflow files to immutable 40-char commit SHAs per the org security policy. Mutable refs like @v4 can be silently re-pointed by a compromised upstream; SHAs cannot. Trailing version comments let Dependabot/Renovate continue to manage updates. Related to [COR-51](https://linear.app/crewai/issue/COR-51). * ci: disable persist-credentials in pip-audit checkout Address CodeRabbit feedback on PR #5869: the pip-audit workflow is read-only and never needs an authenticated git context, so opt out of persisting the GITHUB_TOKEN in the local git config per the actions/checkout security guidance.	2026-05-21 18:08:34 -05:00
Greyson LaLonde	d7252bfee7	fix: pin Node to LTS 22 in docs broken links workflow Mintlify doesn't support Node 25+, and `node-version: latest` was pulling 25.8.2 causing the workflow to fail.	2026-03-27 02:36:11 +08:00
Greyson LaLonde	ffd717c51a	fix: custom tool docs links, add mintlify broken links action (#3903 ) Some checks failed CodeQL Advanced / Analyze (actions) (push) Has been cancelled Details CodeQL Advanced / Analyze (python) (push) Has been cancelled Details Check Documentation Broken Links / Check broken links (push) Has been cancelled Details Notify Downstream / notify-downstream (push) Has been cancelled Details * fix: update docs links to point to correct endpoints * fix: update all broken doc links	2025-11-12 22:55:10 -08:00

3 Commits