slaguru666/AIPass
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: harden workflows — least-privilege permissions + SHA-pinned actions

Browse Source
This commit is contained in:
AIOSAI
2026-05-29 23:47:27 -07:00
parent 4c33cc1f69
commit efa5aced74
6 changed files with 51 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ci.yml
+12 -9
View File
@@ -6,6 +6,9 @@ on:
pull_request:
branches: [main, dev]
permissions:
contents: read
env:
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
@@ -13,8 +16,8 @@ jobs:
lint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: "3.13"
- run: pip install ruff
@@ -28,8 +31,8 @@ jobs:
python-version: ["3.10", "3.11", "3.12", "3.13"]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: ${{ matrix.python-version }}
- run: |
@@ -41,8 +44,8 @@ jobs:
name: seedgo-audit
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: "3.13"
- run: |
@@ -56,8 +59,8 @@ jobs:
needs: [test]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: "3.13"
- run: |
@@ -65,7 +68,7 @@ jobs:
pip install -e ".[dev]"
- run: coverage run -m pytest --rootdir=.
- run: coverage xml
- uses: codecov/codecov-action@v6
- uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
with:
files: ./coverage.xml
fail_ci_if_error: false