ci: add permissions, a concurrency group, and pin actions to SHAs - #50
Open
sidgaikwad wants to merge 1 commit into
Open
ci: add permissions, a concurrency group, and pin actions to SHAs#50sidgaikwad wants to merge 1 commit into
sidgaikwad wants to merge 1 commit into
Conversation
- permissions: contents: read. Both jobs only read the repo; the Codecov upload authenticates with its own token, not the workflow token. - concurrency: cancel superseded PR runs. Pushing twice to a PR left the earlier 6-job matrix occupying runners for a result nobody reads. Guarded on pull_request so main pushes still run to completion. - Pin actions/checkout, actions/setup-node and codecov/codecov-action to commit SHAs with version comments. The pins are the exact commits the v4/v4/v5 tags resolve to today, so this changes nothing about what runs. Dependabot already watches the github-actions ecosystem, so it keeps the SHAs current automatically. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
@sidgaikwad is attempting to deploy a commit to the Unlayer Team on Vercel. A member of the Team first needs to authorize it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #33.
Three standard hardening/efficiency settings, no behavioural change to what CI actually runs.
permissions: contents: readNeither job declared permissions, so both ran with the repository-wide default
GITHUB_TOKENscopes. They only need to read the repo — the Codecov step authenticates withsecrets.CODECOV_TOKEN, not the workflow token.concurrencygroupPushing twice in quick succession to a PR left the superseded run occupying runners for the full 6-job matrix. Guarded on
github.event_name == 'pull_request'so pushes tomainstill run to completion rather than cancelling each other.SHA-pinned actions
actions/checkout,actions/setup-nodeandcodecov/codecov-actionwere on floating major tags.These pins are the exact commits
v4/v4/v5resolve to right now, so nothing about what executes changes — this is purely removing the mutable indirection:actions/checkout11d5960actions/setup-node49933eacodecov/codecov-action0fb7174I deliberately did not bump the majors (v7/v7/v7 are current) — that is a separate change, and
.github/dependabot.ymlalready watches thegithub-actionsecosystem, so Dependabot will open those PRs and keep the SHAs current from here on.