From 818f77bd14bf53f1225d10450ac9d465436d4479 Mon Sep 17 00:00:00 2001 From: Thomas A Caswell Date: Tue, 8 Jul 2025 19:05:48 -0400 Subject: [PATCH 1/6] CI: harden GHA configuration This adjusts the defaults per suggestions of zizmor to reduce possible risks from giving GHA tasks more permissions that required. --- .github/workflows/cd.yml | 1 + .github/workflows/ci.yml | 2 ++ 2 files changed, 3 insertions(+) diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml index 1e70a5be..3f69c508 100644 --- a/.github/workflows/cd.yml +++ b/.github/workflows/cd.yml @@ -28,6 +28,7 @@ jobs: - uses: actions/checkout@v4 with: fetch-depth: 0 + persist-credentials: false - uses: hynek/build-and-inspect-python-package@v2 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 21e5ae10..bfb179c3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -24,6 +24,7 @@ jobs: - uses: actions/checkout@v4 with: fetch-depth: 0 + persist-credentials: false - uses: actions/setup-python@v5 with: python-version: "3.x" @@ -45,6 +46,7 @@ jobs: - uses: actions/checkout@v4 with: fetch-depth: 0 + persist-credentials: false - uses: actions/setup-python@v5 with: From 04e8db99cfc12d6b3b850883ace490122524947b Mon Sep 17 00:00:00 2001 From: Thomas A Caswell Date: Tue, 8 Jul 2025 19:31:33 -0400 Subject: [PATCH 2/6] CI: pin actions by SHA This eliminates the possibility of a tag being changed under us. --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bfb179c3..b1925a37 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -28,7 +28,7 @@ jobs: - uses: actions/setup-python@v5 with: python-version: "3.x" - - uses: pre-commit/action@v3.0.1 + - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1 with: extra_args: --hook-stage manual --all-files @@ -62,6 +62,6 @@ jobs: --durations=20 - name: Upload coverage report - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5 with: token: ${{ secrets.CODECOV_TOKEN }} From 1e9050f13539cce89a725d7c55c5330075f6d061 Mon Sep 17 00:00:00 2001 From: Thomas A Caswell Date: Tue, 8 Jul 2025 19:49:11 -0400 Subject: [PATCH 3/6] CI: pin actions by SHA This eliminates the possibility of a tag being changed under us. --- .github/workflows/cd.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml index 3f69c508..f9301767 100644 --- a/.github/workflows/cd.yml +++ b/.github/workflows/cd.yml @@ -30,7 +30,7 @@ jobs: fetch-depth: 0 persist-credentials: false - - uses: hynek/build-and-inspect-python-package@v2 + - uses: hynek/build-and-inspect-python-package@c52c3a4710070b50470d903818a7b25115dcd076 # v2.13.0 publish: needs: [dist] From c60395119e08b28769248d1055981f92c4247b19 Mon Sep 17 00:00:00 2001 From: Thomas A Caswell Date: Tue, 8 Jul 2025 19:59:26 -0400 Subject: [PATCH 4/6] CI: pin actions by SHA This eliminates the possibility of a tag being changed under us. --- .github/workflows/cd.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml index f9301767..a7212ea3 100644 --- a/.github/workflows/cd.yml +++ b/.github/workflows/cd.yml @@ -54,7 +54,7 @@ jobs: with: subject-path: "dist/*" - - uses: pypa/gh-action-pypi-publish@release/v1 + - uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4 with: # Remember to tell (test-)pypi about this repo before publishing # Remove this line to publish to PyPI From 49e82ea5ff2119e5523633e06328bef9cf53f37f Mon Sep 17 00:00:00 2001 From: Thomas A Caswell Date: Tue, 8 Jul 2025 20:25:12 -0400 Subject: [PATCH 5/6] CI: Restrict default permissions Reduces risk of arbitrary code is run by attacker. --- .github/workflows/ci.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b1925a37..feec6188 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,4 +1,6 @@ name: CI +permissions: + contents: read on: workflow_dispatch: From 98308ac85af66beba8891bc4c6cf2cb3f71bdfe7 Mon Sep 17 00:00:00 2001 From: Thomas A Caswell Date: Tue, 8 Jul 2025 21:10:11 -0400 Subject: [PATCH 6/6] STY: update whitespace in yaml --- .github/workflows/cd.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml index a7212ea3..a528e113 100644 --- a/.github/workflows/cd.yml +++ b/.github/workflows/cd.yml @@ -54,7 +54,7 @@ jobs: with: subject-path: "dist/*" - - uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4 + - uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4 with: # Remember to tell (test-)pypi about this repo before publishing # Remove this line to publish to PyPI