From c86a7a3721a3e71874582ee6d685ec41e7f68da4 Mon Sep 17 00:00:00 2001 From: GSServita Date: Thu, 30 Jul 2026 13:51:39 +0100 Subject: [PATCH] QVAC-22740 infra: bump CodeScan caller to qvac-actions 0.3.0 Bump the reusable security workflow pin 0.2.0 -> 0.3.0 (SHA bbb0740e). 0.3.0 adds the findings-export artifact (export-report default on), so each run now publishes a downloadable security-scan-report (findings.json/md + SARIF). --- .github/workflows/security-baseline.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security-baseline.yml b/.github/workflows/security-baseline.yml index 335bb805c..aa5c8a96f 100644 --- a/.github/workflows/security-baseline.yml +++ b/.github/workflows/security-baseline.yml @@ -32,7 +32,7 @@ jobs: baseline: # Pinned to the qvac-actions 0.2.0 release commit (immutable SHA + version # comment, per the org freeze-and-pin convention). - uses: tetherto/qvac-actions/.github/workflows/public-reusable-security.yml@be1d22629cc48b6dcc36645acc9e6d89cfaf54d8 # 0.2.0 + uses: tetherto/qvac-actions/.github/workflows/public-reusable-security.yml@bbb0740e2a16b94371c7439e0e06945c5b68e759 # 0.3.0 permissions: contents: read security-events: write