fix: harden the workflows — spoofable actor check and overly broad permissions #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright (C) 2026 Sten Tijhuis | |
| # SPDX-License-Identifier: MIT | |
| name: Update tool SHA256 checksums | |
| # Renovate bumps the pinned tool versions but cannot compute a checksum, so on | |
| # its own every bump lands with the previous release's hash still in place and | |
| # the build stops at "computed checksum did NOT match". This recalculates the | |
| # hashes on Renovate's pull requests and commits them back onto the branch. | |
| # | |
| # Renovate must be told to ignore those commits, or it treats the branch as | |
| # modified by someone else and stops maintaining the pull request. That is the | |
| # gitIgnoredAuthors entry in renovate.json. | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| branches: [main, development] | |
| paths: | |
| - '.github/workflows/config-validation.yml' | |
| - '.github/workflows/pr-checks.yml' | |
| - '.github/scripts/update-tool-checksums.sh' | |
| permissions: {} | |
| jobs: | |
| update-checksums: | |
| name: Recalculate SHA256 checksums | |
| runs-on: ubuntu-latest | |
| # Only Renovate's own branches. Running this on a human's pull request | |
| # would mean pushing commits to a branch someone is actively working on. | |
| # | |
| # The author of the pull request, not github.actor. actor is whoever | |
| # triggered the most recent event, which on a synchronize is whoever pushed | |
| # last; comparing that to a bot name is a check zizmor rightly calls | |
| # spoofable. The author is fixed when the pull request is opened and cannot | |
| # be set to another account. | |
| if: >- | |
| startsWith(github.head_ref, 'renovate/') && | |
| github.event.pull_request.user.login == 'renovate[bot]' | |
| permissions: | |
| contents: write | |
| steps: | |
| # persist-credentials: false, even though this job pushes. Otherwise the | |
| # token sits in .git/config for the whole job, including while the script | |
| # below downloads release tarballs off the internet. The push step gets | |
| # the token explicitly instead, for exactly one command. | |
| - name: Check out the pull request branch | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ github.head_ref }} | |
| persist-credentials: false | |
| # The script verifies each download against the checksum the project | |
| # publishes next to the release before writing anything, so a hash only | |
| # lands here if upstream vouches for it too. | |
| - name: Recalculate and apply checksums | |
| run: .github/scripts/update-tool-checksums.sh --apply | |
| - name: Commit updated checksums | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| BRANCH: ${{ github.head_ref }} | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| git add .github/workflows/config-validation.yml .github/workflows/pr-checks.yml | |
| if git diff --staged --quiet; then | |
| echo "Checksums are already up to date, nothing to commit." | |
| else | |
| git commit -m "chore: update tool SHA256 checksums" | |
| git push "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" \ | |
| "HEAD:refs/heads/${BRANCH}" | |
| fi |