From 6f2716bf1fcd05a3c341f50cac28862b2bf2a87d Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Sat, 5 Sep 2026 14:08:46 -0700 Subject: [PATCH] fix(security): pin 14 action refs to SHAs and add a token permissions floor All 14 third-party action refs ran from mutable tags. A tag is repointable by whoever controls the action repo, so the workflows trusted a moving target. Each now pins a commit SHA with the version kept in a trailing comment. 2 workflow(s) had no top-level permissions block, so any job without its own block inherited the repository default. contents: read is now the floor. Jobs that already declared their own permissions keep them, so nothing loses a capability it was using. Workflow-only, no source or test changes. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01XbDBXDWWvMFa7c2jGgyq9t --- .github/workflows/ci.yml | 7 +++++-- .github/workflows/codeql.yml | 8 ++++---- .github/workflows/docs.yml | 4 ++-- .github/workflows/publish.yml | 8 ++++---- .github/workflows/sbom.yml | 3 +++ .github/workflows/scorecard.yml | 4 ++-- 6 files changed, 20 insertions(+), 14 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 976dbc23..0cdd6f87 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -8,6 +8,9 @@ on: env: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" +permissions: + contents: read + jobs: test: runs-on: ubuntu-latest @@ -16,9 +19,9 @@ jobs: python-version: ["3.11", "3.12"] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 4cef828d..6ceb403b 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -25,18 +25,18 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@v4.37.9 + uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: languages: python queries: +security-extended - name: Autobuild - uses: github/codeql-action/autobuild@v4.37.9 + uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.37.9 + uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: category: /language:python diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index c2ea2111..6b7ba231 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -36,11 +36,11 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.11" cache: pip diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index a3513de3..9745c595 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -16,9 +16,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.11" @@ -47,7 +47,7 @@ jobs: --workspace "$GITHUB_WORKSPACE" \ --expected-version "${GITHUB_REF_NAME#v}" - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0 with: name: dist path: dist/ @@ -57,7 +57,7 @@ jobs: runs-on: ubuntu-latest environment: pypi steps: - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.0 with: name: dist path: dist/ diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml index d3d3c948..0c4b2605 100644 --- a/.github/workflows/sbom.yml +++ b/.github/workflows/sbom.yml @@ -9,6 +9,9 @@ on: env: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" +permissions: + contents: read + jobs: sbom: runs-on: ubuntu-latest diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 79373b31..4245fdf4 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -20,7 +20,7 @@ jobs: actions: read steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false fetch-depth: 0 @@ -35,6 +35,6 @@ jobs: publish_results: false - name: Upload SARIF - uses: github/codeql-action/upload-sarif@v4.37.9 + uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: sarif_file: scorecard-results.sarif