ci: Harden GitHub Actions workflows by gcl-sekoia · Pull Request #9 · SEKOIA-IO/Cortex-XSOAR-integration

gcl-sekoia · 2026-03-24T11:17:11Z

Summary

Configure Dependabot for GitHub Actions (weekly schedule, 14-day cooldown, grouped version updates)
Pin actions to commit SHAs (14-day minimum age)
Least-privilege permissions (deny-all at workflow level, minimal job-level grants)
Fix zizmor findings (template injection via env var indirection, pin unpinned action)
Fix actionlint findings (quote shell variables, remove invalid branches filter on delete event)

gcl-sekoia added 2 commits March 24, 2026 12:47

ci: configure Dependabot for GitHub Actions

4c4c567

ci: pin actions to commit SHAs

7b06ef9

gcl-sekoia force-pushed the gha-security/harden branch from 723a626 to 54c94ee Compare March 24, 2026 11:47

gcl-sekoia added 3 commits March 24, 2026 12:51

ci: add least-privilege permissions

23d0403

ci: fix zizmor findings

f2a6e1e

ci: fix actionlint findings

3cd9f17

gcl-sekoia force-pushed the gha-security/harden branch from 54c94ee to 3cd9f17 Compare March 24, 2026 11:51

gcl-sekoia marked this pull request as ready for review March 24, 2026 11:53