From efa5aced74ebb7b3d3e31cad3a5504f4f1d95c8b Mon Sep 17 00:00:00 2001 From: AIOSAI Date: Fri, 29 May 2026 23:47:27 -0700 Subject: [PATCH] =?UTF-8?q?ci:=20harden=20workflows=20=E2=80=94=20least-pr?= =?UTF-8?q?ivilege=20permissions=20+=20SHA-pinned=20actions?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/ci.yml | 21 ++++++++++++--------- .github/workflows/macos-test.yml | 9 ++++++--- .github/workflows/publish.yml | 17 ++++++++++------- .github/workflows/security.yml | 15 ++++++++++----- .github/workflows/stale.yml | 8 +++++++- .github/workflows/windows-test.yml | 9 ++++++--- 6 files changed, 51 insertions(+), 28 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 59fd1f87..ac490eb0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,6 +6,9 @@ on: pull_request: branches: [main, dev] +permissions: + contents: read + env: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" @@ -13,8 +16,8 @@ jobs: lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: "3.13" - run: pip install ruff @@ -28,8 +31,8 @@ jobs: python-version: ["3.10", "3.11", "3.12", "3.13"] runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: ${{ matrix.python-version }} - run: | @@ -41,8 +44,8 @@ jobs: name: seedgo-audit runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: "3.13" - run: | @@ -56,8 +59,8 @@ jobs: needs: [test] runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: "3.13" - run: | @@ -65,7 +68,7 @@ jobs: pip install -e ".[dev]" - run: coverage run -m pytest --rootdir=. - run: coverage xml - - uses: codecov/codecov-action@v6 + - uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1 with: files: ./coverage.xml fail_ci_if_error: false diff --git a/.github/workflows/macos-test.yml b/.github/workflows/macos-test.yml index a580bf31..8e502d3f 100644 --- a/.github/workflows/macos-test.yml +++ b/.github/workflows/macos-test.yml @@ -16,13 +16,16 @@ on: - 'src/aipass/drone/cli.py' - 'pyproject.toml' +permissions: + contents: read + jobs: macos-setup: runs-on: macos-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/setup-python@v5 + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: '3.12' @@ -44,7 +47,7 @@ jobs: - name: Upload test results if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: macos-pytest-results path: pytest-output.txt diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 0d1ccea4..528e3556 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -5,17 +5,20 @@ on: tags: - "v*" +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: "3.13" - run: pip install build - run: python -m build - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: dist path: dist/ @@ -27,11 +30,11 @@ jobs: permissions: id-token: write steps: - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 with: name: dist path: dist/ - - uses: pypa/gh-action-pypi-publish@release/v1 + - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0 github-release: needs: publish @@ -39,8 +42,8 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v4 - - uses: actions/download-artifact@v4 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 with: name: dist path: dist/ diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index d788a6f5..72678f8e 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -8,6 +8,9 @@ on: schedule: - cron: "0 6 * * 1" +permissions: + contents: read + env: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" @@ -15,8 +18,8 @@ jobs: dependency-scan: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: "3.13" - run: pip install pip-audit @@ -27,10 +30,12 @@ jobs: codeql: runs-on: ubuntu-latest permissions: + contents: read + actions: read security-events: write steps: - - uses: actions/checkout@v4 - - uses: github/codeql-action/init@v3 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3 with: languages: python - - uses: github/codeql-action/analyze@v3 + - uses: github/codeql-action/analyze@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3 diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index 2ee70f87..b34cf4d2 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -4,11 +4,17 @@ on: schedule: - cron: "0 0 * * 1" +permissions: + contents: read + jobs: stale: runs-on: ubuntu-latest + permissions: + issues: write + pull-requests: write steps: - - uses: actions/stale@v10 + - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0 with: stale-issue-message: "This issue has been inactive for 30 days. It will be closed in 7 days if no further activity occurs." days-before-stale: 30 diff --git a/.github/workflows/windows-test.yml b/.github/workflows/windows-test.yml index 58748619..f5d32e9c 100644 --- a/.github/workflows/windows-test.yml +++ b/.github/workflows/windows-test.yml @@ -16,13 +16,16 @@ on: - 'src/aipass/drone/cli.py' - 'pyproject.toml' +permissions: + contents: read + jobs: windows-setup: runs-on: windows-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/setup-python@v5 + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: '3.12' @@ -49,7 +52,7 @@ jobs: - name: Upload test results if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: windows-pytest-results path: pytest-output.txt