CI: Harden GHA configuration#102
Conversation
This eliminates the possibility of a tag being changed under us.
This eliminates the possibility of a tag being changed under us.
May include: - Avoids risky string interpolation. - Prevents checkout premissions from leaking
Reduces risk of arbitrary code is run by attacker.
Reduces risk of arbitrary code is run by attacker.
| contents: write | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 |
There was a problem hiding this comment.
No actions are pinned in this file.
|
The tool I used to find un-pinned actions (zizmor) does not flag the "official" I suspect the logic is if someone manages to compromise GH there are more direct ways to cause trouble than funny side-band attacks via GHA. |
Co-authored-by: Elliott Sales de Andrade <quantum.analyst@gmail.com>
|
I think you need to run with the pedantic persona to catch those. |
dstansby
left a comment
dstansby
left a comment
There was a problem hiding this comment.
Since even without pinning the actions/* workflows this is an improvement, I will merge.
|
I think think broke things: https://github.com/matplotlib/mpl-brochure-site/actions/runs/18060765685/job/51396687512 |
|
Yes, it looks like it should have |
3 participants
Apply recommended hardening steps including: