Skip to content

CI: Harden GHA configuration #308

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

CI: Harden GHA configuration #308

wants to merge 5 commits into from
+31 −6

Conversation

tacaswell
Copy link
Member

Apply recommended hardening steps including:

  • pinning to a SHA any actions used
  • not persisting the read token on checkout
  • setting the default permissions
  • adding a depandabot file for GHA

tacaswell added 5 commits July 17, 2025 21:02
@tacaswell
CI: pin actions by SHA
9c959e9 
This eliminates the possibility of a tag being changed under
us.
@tacaswell
CI: pin actions by SHA
f1b0255 
This eliminates the possibility of a tag being changed under
us.
@tacaswell
CI: auto-fix via zizmor
3e690b4 
May include:

- Avoids risky string interpolation.
- Prevents checkout premissions from leaking
@tacaswell
CI: Restrict default permissions
df58a93 
Reduces risk of arbitrary code is run by attacker.
@tacaswell
CI: run pre-commit on GHA
90e38c3
@tacaswell
Copy link
Member Author

See matplotlib/matplotlib#30045 but precommit.ci has been disabled at the org level, not sure what else needs to be done to get rid of the check.

@samcunliffe
Copy link
Collaborator

precommit.ci has been disabled at the org level, not sure what else needs to be done to get rid of the check

Looks like that worked! pre-commit.ci is one of our required checks, and it hasn't run. So @dstansby (or anyone else with access to repo settings) we just need to switch to requiring the GHA "precommit" added here.

Screenshot 2025-07-19 at 11 11 07

👍 Dependabot will send update PRs updating the SHAs.

@samcunliffe samcunliffe added Maintenance dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 19, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@samcunliffe samcunliffe samcunliffe approved these changes

Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code Maintenance
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@tacaswell @samcunliffe