ci: pin actions to commit SHAs and set least privilege permissions - #75
Merged
royalpinto007 merged 1 commit intoAug 7, 2026
Conversation
actions/checkout, actions/setup-node, and actions/github-script were all referenced by mutable tag (@v7), so whoever controls those repos could repoint the tag at different code. contributors.yml runs some of these jobs from pull_request_target and issue_comment, which have write access and secrets, so a repointed tag there is a path to repo write. Pin every uses: to a full commit SHA with the resolved version in a trailing comment, and add a top level permissions: contents: read to ci.yml, which had no permissions block at all before this.
|
Merged. Thanks a lot, @waterlemonnn. agentpostmortem gets better every time someone outside the repo digs in like this. If you find agentpostmortem useful, consider dropping a star. It helps more people find it. Happy to see more from you whenever you have the time. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #43
.github/workflows/ci.yml,contributors.yml, andpr-title.ymlall referencedactions/checkout,actions/setup-node, andactions/github-scriptby mutable tag (@v7). Tags can be repointed by whoever controls the action repo, andcontributors.ymlruns several of these steps frompull_request_targetandissue_comment, which get write access and secret access from contexts a fork can influence. Pinning to a commit SHA closes that off.uses:in all three workflow files to the full 40-char commit SHA that@v7currently resolves to, with the human-readable version as a trailing comment (actions/checkout@<sha> # v7.0.1,actions/setup-node@<sha> # v7.0.0,actions/github-script@<sha> # v7.1.0). Resolved via the GitHub API against each action repo's tag refs, not guessed.permissions: contents: readblock toci.yml, which had nopermissions:at all before this (so its jobs were running with the repo default token scope).contributors.ymlalready sets narrower per-job permissions and didn't need changes..github/dependabot.ymlalready has agithub-actionsecosystem entry, so pins will get bumped by PR going forward.pull_request_targetjob incontributors.yml: none of its jobs check out or execute PR code, they only callactions/github-scriptwith an inline script against the GitHub API.Verified:
grep -rn "uses:.*@v" .github/workflows/returns nothing, all SHAs are 40 hex chars, and all three workflow files still parse withjs-yaml.