RB

Is this still maintained?

2

Hi folks. Thanks for providing this and maintaining it. I noticed that the last release was in 2021 so no changes in about 4 years. We're always trying to make...

`checks: write` gha permission is needed for pushing SARIF annotations on Pull Requests

2

https://securityscorecards.dev/viewer/?uri=github.com/runatlantis/atlantis ``` Warn: topLevel 'checks' permission set to 'write': .github/workflows/lint.yml:24 ``` In our case, to push SARIF annotations in a PR from a linter like golangci-lint, it requires `checks: write`...

### Describe the bug When using c7n-org and default C7N_ORG_PARALLEL, I see the following error ```shell 2025-12-04 21:48:36,257: c7n_org:WARNING Error running policy in dev @ us-east-1 exception: A process in...

serverless policy provisioning with terraform

8

Thank you for a great product! Is there a set of guidelines of best practices to use CloudCustodian in conjunction with Terraform? For instance, I'm using the Lambda functionality and...

In light of the recent tj-actions events, it would be nice to improve this score so users feel safer when using it. https://scorecard.dev/viewer/?uri=github.com/trstringer/manual-approval [](https://scorecard.dev/viewer/?uri=github.com/trstringer/manual-approval) ``` [](https://scorecard.dev/viewer/?uri=github.com/trstringer/manual-approval) ``` https://scorecard.dev/...

[](https://scorecard.dev/viewer/?uri=github.com/thollander/actions-comment-pull-request) https://scorecard.dev/viewer/?uri=github.com/thollander/actions-comment-pull-request https://app.stepsecurity.io/?repo=https://github.com/thollander/actions-comment-pull-request This will increase the repo settings, actions, and code base's security posture This is to avoid an issue like what happened to the recent tj-actions incident

[](https://scorecard.dev/viewer/?uri=github.com/mshick/add-pr-comment) https://scorecard.dev/viewer/?uri=github.com/mshick/add-pr-comment https://app.stepsecurity.io/?repo=https://github.com/mshick/add-pr-comment This will increase the repo settings, actions, and code base's security posture This is to avoid an issue like what happened to the recent tj-actions incident

Thanks for maintaining this action. Would you please consider adding dependabot or renovatebot to keep this repo/action up to date? This should help with it's security updates and all. Thanks!

Please publish major version tags (similar to actions/checkout)

1

So basically, if you cut a v2 tag to match the sha in v2.2.0, and do that going forward, then we can keep our tag to v2 or we would...