Skip to content

chore: harden GitHub Actions workflows#13

Merged
nikuscs merged 1 commit into
mainfrom
security/harden-ci-glooit
May 12, 2026
Merged

chore: harden GitHub Actions workflows#13
nikuscs merged 1 commit into
mainfrom
security/harden-ci-glooit

Conversation

@nikuscs
Copy link
Copy Markdown
Owner

@nikuscs nikuscs commented May 12, 2026

Summary

  • pin GitHub Actions dependencies to full commit SHAs with version comments
  • reduce default workflow token permissions and scope write/OIDC permissions to the release job
  • disable persisted checkout credentials in non-push test jobs

Validation

  • parsed .github/workflows/release.yml and .github/workflows/test.yml with Ruby YAML loader
  • verified production environment now has a required reviewer configured

Notes

  • This PR focuses on CI hardening only. Repository ruleset/branch protection already exists for main.

@nikuscs nikuscs merged commit 3773abf into main May 12, 2026
1 check passed
@nikuscs nikuscs deleted the security/harden-ci-glooit branch May 12, 2026 09:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant