chore: GH Actions hardening — pin actions to SHA, add permissions and timeouts#204
Conversation
… timeouts Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
cubic analysis
No issues found across 1 file
Confidence score: 5/5
- Automated review surfaced no issues in the provided summaries.
- No files require special attention.
Linked issue analysis
Linked issue: DEV-663: [resend-python] GH Actions hardening — 1 HIGH / 1 MED / 2 LOW
| Status | Acceptance criteria | Notes |
|---|---|---|
| ✅ | Pin codecov/codecov-action@v6 to a commit SHA | Diff replaces uses: codecov/codecov-action@v6 with a pinned commit SHA and keeps the v6 comment. |
| ✅ | Add top-level permissions | Diff adds a top-level permissions block granting contents: read. |
| ✅ | Add timeout-minutes to jobs that were missing them (two jobs) | Diff adds timeout-minutes to the lint-mypy job and to the tests job (values 10 and 15 respectively). |
Auto-approved: These changes harden the CI workflow by adding read-only permissions, job timeouts, and pinning an action to a commit SHA—all security and reliability best practices with no impact on application logic or data.
There was a problem hiding this comment.
0 issues found across 1 file (changes from recent commits).
Auto-approved: These GitHub Actions hardening changes (pinning actions to commit SHAs, adding read-only permissions, and setting timeouts) are low-risk, do not alter any business logic, and improve security and reliability without affecting the application code.
dielduarte
deleted the
feature/dev-663-resend-python-gh-actions-hardening-1-high-1-med-2-low
branch
2 participants
Summary by cubic
Hardens GitHub Actions by pinning
actions/checkout,actions/setup-python, andcodecov/codecov-actionto commit SHAs, adding top‑levelpermissions: { contents: read }, and setting CI job timeouts (Lint/Mypy 10m, Tests 15m). Addresses Linear DEV-663 (HIGH: pin actions; MED: add permissions; LOW: add missing timeouts).Written for commit 79a6307. Summary will update on new commits.