ci: GITHUB_TOKEN権限の最小化とActionsのSHAピン留め (#19)#24
Merged
Conversation
## 理由 CI ワークフローに明示的な permissions が無く GITHUB_TOKEN が過剰権限に フォールバックし得る、Actions が可変タグ参照でタグ乗っ取り時にサプライチェーン リスクがある、加えて checkout@v4 / setup-go@v5 が Node.js 20 で deprecated 警告を 出していた(#19)。 ## 修正点 - permissions: contents: read を最小権限として明示(#11) - actions/checkout を v6.0.3 (df4cb1c)、actions/setup-go を v6.4.0 (4a36011) に コミット SHA でピン留め(#12)。両者とも node24 稼働で Node.js 20 deprecated も解消 - .github/dependabot.yml を追加し、github-actions の更新を自動化して SHA ピンの陳腐化を防止
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概要
CI ワークフローのサプライチェーン/権限ハードニングと、Node.js 20 deprecated 警告の解消をまとめて行います。
Closes #19
背景(監査検出 + CI 警告)
permissions:が無く、GITHUB_TOKENがリポジトリ既定(しばしば read-write)にフォールバック。ジョブはgo testのみでcontents: readで十分actions/checkout@v4/actions/setup-go@v5が可変タグ参照。タグ乗っ取り/リポジトリ侵害時に攻撃者コードが透過的に走るactions/checkout@v4/actions/setup-go@v5が Node.js 20 deprecated(2026-09-16 削除予定)の警告を出していた変更点
permissions: contents: read(add readme #11)actions/checkout→df4cb1c069e1874edd31b4311f1884172cec0e10# v6.0.3actions/setup-go→4a3601121dd01d1626a1e23e37211e3254c1c06c# v6.4.0runs.using: node24を確認済み → Node.js 20 deprecated も解消.github/dependabot.yml):github-actionsを weekly 更新し、SHA ピンの陳腐化を防止検証
test.yml/dependabot.ymlの YAML 妥当性を確認済み🤖 Generated with Claude Code