wt/json
1
0 Fork 0
mirror of https://github.com/nlohmann/json.git synced 2026-11-10 16:31:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci: install the remaining pip dependencies with --require-hashes (#6050)

Browse Source 
Install Semgrep from a new hash-pinned requirements file in
cmake/requirements (covered by Dependabot) instead of a version-only
"pip install semgrep==1.168.0", and pass --require-hashes to the astyle
and natvis installs in check_amalgamation.yml, whose requirements files
got their hashes in #6046. Addresses the Scorecard Pinned-Dependencies
code-scanning alerts for semgrep.yml and check_amalgamation.yml.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>
This commit is contained in:
Niels Lohmann authored and GitHub committed 2026-11-10 08:33:30 +01:00
1 parent a78e2a6b10
commit eac1b4343b
3 files changed
+992 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.github/workflows/check_amalgamation.yml
+2 -2
View File
@@ -67,10 +67,10 @@ jobs:
- name: Install astyle
run: |
python3 -mvenv venv
venv/bin/pip3 install -r $MAIN_DIR/tools/astyle/requirements.txt
venv/bin/pip3 install --require-hashes -r $MAIN_DIR/tools/astyle/requirements.txt
- name: Install generate_natvis dependencies
run: pip3 install -r $NATVIS_TOOL_DIR/requirements.txt
run: pip3 install --require-hashes -r $NATVIS_TOOL_DIR/requirements.txt
- name: Regenerate the tools/macro_builder tables in macro_scope.hpp
run: |