Harden CI permissions and pin actions; add Dependabot config - #1
Merged
Conversation
Supply-chain hardening ahead of open-sourcing.
Workflow permissions are now deny-by-default: `permissions: {}` at the
workflow level, with the test job granting only `contents: read`. The
repository default was already read-only, but stating it in the file means a
later job cannot silently inherit a wider scope.
Actions are pinned to full commit SHAs rather than the `v7` tags. A tag is a
mutable ref; whoever can move it can run arbitrary code in this workflow with
whatever the job holds. Both pins are the current tips of v7.0.1 and v7.0.0
respectively, so this is behaviorally a no-op today. checkout also gets
`persist-credentials: false` so the job token is not left in .git/config for
later steps to reuse.
Pinning to a SHA means an action never receives an upstream security fix on
its own, so .github/dependabot.yml is what makes the pins maintainable: weekly
grouped updates for github-actions, and for pip to cover the optional [tools]
and [dev] extras (the runtime dependency list is empty).
Dependabot alerts and security updates are enabled on the repository. Secret
scanning and push protection are not available on a private repository; they
are free once this goes public and should be turned on at that point.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0114gUUe4CxYr8W8oC95ffmD
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supply-chain hardening ahead of open-sourcing.
Workflow permissions are now deny-by-default:
permissions: {}at theworkflow level, with the test job granting only
contents: read. Therepository default was already read-only, but stating it in the file means a
later job cannot silently inherit a wider scope.
Actions are pinned to full commit SHAs rather than the
v7tags. A tag is amutable ref; whoever can move it can run arbitrary code in this workflow with
whatever the job holds. Both pins are the current tips of v7.0.1 and v7.0.0
respectively, so this is behaviorally a no-op today. checkout also gets
persist-credentials: falseso the job token is not left in .git/config forlater steps to reuse.
Pinning to a SHA means an action never receives an upstream security fix on
its own, so .github/dependabot.yml is what makes the pins maintainable: weekly
grouped updates for github-actions, and for pip to cover the optional [tools]
and [dev] extras (the runtime dependency list is empty).
Dependabot alerts and security updates are enabled on the repository. Secret
scanning and push protection are not available on a private repository; they
are free once this goes public and should be turned on at that point.
Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_0114gUUe4CxYr8W8oC95ffmD