Skip to content

ci: pin actions and restrict workflow permissions - #15

Merged
mstuart merged 1 commit into
masterfrom
chore/actions-hardening
Aug 23, 2026
Merged

ci: pin actions and restrict workflow permissions#15
mstuart merged 1 commit into
masterfrom
chore/actions-hardening

Conversation

@mstuart

@mstuart mstuart commented Aug 23, 2026

Copy link
Copy Markdown
Owner

Summary

  • grant CI only contents: read instead of relying on repository token defaults
  • pin every actions/checkout and actions/setup-node v7 use to the exact commit currently behind v7
  • preserve the existing release and security-audit write scopes

Pinned refs were verified through the GitHub API:

  • actions/checkout v7: 3d3c42e5aac5ba805825da76410c181273ba90b1
  • actions/setup-node v7: 820762786026740c76f36085b0efc47a31fe5020

Verification

  • all 3 workflow YAML files parsed
  • exact permission scopes verified
  • all 6 external action refs are full SHAs with version comments
  • npm run check
  • npm test (14 tests)
  • npm run build --if-present

@mstuart
mstuart merged commit 2211178 into master Aug 23, 2026
7 checks passed
mstuart added a commit that referenced this pull request Aug 24, 2026
Co-authored-by: Mark Stuart <mstuart@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant