From c070aa061c08053b6db31125b44eb2cb9ae96fe9 Mon Sep 17 00:00:00 2001 From: Anarchid Date: Fri, 7 Aug 2026 14:45:15 +0300 Subject: [PATCH] ci: pin every action to an immutable SHA; stop persisting checkout credentials MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A Greptile review on the membrane rollout of this same policy (antra-tess/membrane#45) flagged the github-release job for running actions/checkout at a mutable major-version ref: retargeting that tag would change the code running with permission to create and edit releases. This repo shipped that publish.yml in an earlier rollout of the policy, so the finding lands here identically — and it is live on main rather than sitting in a PR. Fixed across every workflow, not just the flagged line: 8 actions pinned to immutable SHAs across changelog.yml, ci.yml and publish.yml, version tags kept as trailing comments so the pins stay readable and Dependabot can still bump them. The review named the least privileged of the write-capable jobs. Two things it did not: - The npm publish job holds `id-token: write` for OIDC trusted publishing. A swapped action there can reach a live publish credential — a worse outcome than edited release notes. - checkout defaults to persist-credentials: true, writing the job token into .git/config where every later step in the job can read it. Nothing here pushes over git — publish uses OIDC, the release job uses gh with GH_TOKEN — so all 4 checkouts now set it false. No behavior change intended: each pinned SHA is the current head of the tag it replaces. Co-Authored-By: Claude Opus 5 --- .github/workflows/changelog.yml | 2 +- .github/workflows/ci.yml | 6 ++++-- .github/workflows/publish.yml | 16 +++++++++++----- 3 files changed, 16 insertions(+), 8 deletions(-) diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml index 5fe3aba7..c8be4729 100644 --- a/.github/workflows/changelog.yml +++ b/.github/workflows/changelog.yml @@ -14,7 +14,7 @@ jobs: if: "!contains(github.event.pull_request.labels.*.name, 'no-changelog')" steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 59360635..01e2b2d4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -23,10 +23,12 @@ jobs: os: [ubuntu-latest, macos-latest] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + with: + persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 20 diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index b44d00d4..e484b9b4 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -15,10 +15,12 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: 20 @@ -49,7 +51,9 @@ jobs: id-token: write steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Require changelog section for this release run: | @@ -61,7 +65,7 @@ jobs: fi - name: Setup Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: # node 24 ships npm >= 11.5.1, required for OIDC publishing. node-version: 24 @@ -89,7 +93,9 @@ jobs: contents: write steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Mirror changelog section into release notes env: