-
Notifications
You must be signed in to change notification settings - Fork 51
CI: Harden GHA configuration #104
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
This eliminates the possibility of a tag being changed under us.
This eliminates the possibility of a tag being changed under us.
May include: - Avoids risky string interpolation. - Prevents checkout premissions from leaking
Reduces risk of arbitrary code is run by attacker.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Not pinning this one to a commit?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Also not pinned to a commit.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
None of the actions are pinned to commit in this file.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
None of the actions are pinned to commits here.
Co-authored-by: Elliott Sales de Andrade <quantum.analyst@gmail.com>
tacaswell
commented
Jul 22, 2025
The tool I used to ID what needed to be pinned (zizmor) does not flag actions/XYZ.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
reviewdog needs write permissions for checks (cf Matplotlib's linting.yml.)
Apply recommended hardening steps including: