From the 2026-08-02 full-repo review (finding F-14, workflow-security part; the sanitizer job itself is tracked in #13).
Evidence (.github/workflows/build.yml): no permissions: block (default token grants write on push builds); actions/checkout@v4 is tag-pinned, not SHA-pinned; no concurrency: group (superseded PR runs keep running). In tests/CMakeLists.txt, googletest (GIT_TAG v1.14.0) and Eigen (GIT_TAG 3.4.0) ride movable tags while numsim-cas, numsim-materials, numsim-core, and CPM.cmake itself are SHA/SHA256-pinned — inconsistent with the repo's otherwise-strict reproducibility discipline.
Proposal (~10 lines total):
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}plus actions/checkout@<full-sha> # v4.x.y, and commit-SHA pins for the gtest/Eigen fetches. Also worth adding: a weekly schedule: run to catch LLVM-apt/pin bit-rot between pushes.
Supporting evidence for #13's ASan job: the full suite already passes ASan+UBSan clean locally (gcc-14, -fno-sanitize-recover=all, 321/321 in ~11 s) — the leg costs one matrix row and starts green.
From the 2026-08-02 full-repo review (finding F-14, workflow-security part; the sanitizer job itself is tracked in #13).
Evidence (
.github/workflows/build.yml): nopermissions:block (default token grants write on push builds);actions/checkout@v4is tag-pinned, not SHA-pinned; noconcurrency:group (superseded PR runs keep running). Intests/CMakeLists.txt, googletest (GIT_TAG v1.14.0) and Eigen (GIT_TAG 3.4.0) ride movable tags while numsim-cas, numsim-materials, numsim-core, and CPM.cmake itself are SHA/SHA256-pinned — inconsistent with the repo's otherwise-strict reproducibility discipline.Proposal (~10 lines total):
plus
actions/checkout@<full-sha> # v4.x.y, and commit-SHA pins for the gtest/Eigen fetches. Also worth adding: a weeklyschedule:run to catch LLVM-apt/pin bit-rot between pushes.Supporting evidence for #13's ASan job: the full suite already passes ASan+UBSan clean locally (gcc-14,
-fno-sanitize-recover=all, 321/321 in ~11 s) — the leg costs one matrix row and starts green.