From 03dc3f676ae643c3c40f350ef15c2550113dca97 Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Sat, 5 Sep 2026 14:08:51 -0700 Subject: [PATCH] fix(security): pin 8 action refs to SHAs and add a token permissions floor All 8 third-party action refs ran from mutable tags. A tag is repointable by whoever controls the action repo, so the workflows trusted a moving target. Each now pins a commit SHA with the version kept in a trailing comment. 1 workflow(s) had no top-level permissions block, so any job without its own block inherited the repository default. contents: read is now the floor. Jobs that already declared their own permissions keep them, so nothing loses a capability it was using. Workflow-only, no source or test changes. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01XbDBXDWWvMFa7c2jGgyq9t --- .github/workflows/ci.yml | 3 +++ .github/workflows/codeql.yml | 8 ++++---- .github/workflows/docs.yml | 4 ++-- .github/workflows/scorecard.yml | 4 ++-- 4 files changed, 11 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ff456df..8934b36 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -9,6 +9,9 @@ on: env: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" +permissions: + contents: read + jobs: test: runs-on: ubuntu-latest diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 4cef828..6ceb403 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -25,18 +25,18 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@v4.37.9 + uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: languages: python queries: +security-extended - name: Autobuild - uses: github/codeql-action/autobuild@v4.37.9 + uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.37.9 + uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: category: /language:python diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 56caa09..3935f8e 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -33,11 +33,11 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.11" cache: pip diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 79373b3..4245fdf 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -20,7 +20,7 @@ jobs: actions: read steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false fetch-depth: 0 @@ -35,6 +35,6 @@ jobs: publish_results: false - name: Upload SARIF - uses: github/codeql-action/upload-sarif@v4.37.9 + uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: sarif_file: scorecard-results.sarif