ci: GitHub Actions workflow security cleanup#361
Open
emptyhammond wants to merge 5 commits into
Open
Conversation
Replace mutable tag references with full commit SHAs (with the original tag preserved in a trailing comment) so workflow runs are reproducible and resistant to tag-retargeting.
Set persist-credentials: false on every actions/checkout so the default GITHUB_TOKEN is not left in the local git config for later workflow steps that do not need it.
Add an explicit top-level permissions block of contents: read to the build/test and Renovate workflows so the implicit broad default GITHUB_TOKEN scope is no longer granted. The docs job retains its existing id-token and deployments write scopes, with contents: read added back since a job-level block replaces the workflow default.
Move github.event.inputs.bucket and github.event.inputs.version out of the shell template-expansion path and into env vars referenced as quoted variables, so the values never become inline shell text at the time the run step is constructed.
In a release-trigger workflow, restoring a previously written cache during build can compromise the published artifact. setup-node v4 does not enable caching by default, but later versions do; set package-manager-cache: false so the opt-out is explicit and survives a future major-version bump.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Routine hygiene pass over the four GitHub Actions workflows in this
repo, addressing findings from a security audit. The changes are
split into five commits, one per finding type:
of inline shell template expansion
workflow's setup-node
No behavioural change is expected: pinned SHAs resolve to the same
commits the existing tags point at today, and the cdn.yml shell
command produces the same S3 URL it did before.