From 60e7500956a193d8f8e81f4065a52e34d49e8576 Mon Sep 17 00:00:00 2001 From: AlgoVoi Date: Mon, 5 Oct 2026 06:03:11 +0000 Subject: [PATCH 1/2] ci: pin GitHub Actions to commit SHAs Pin the GitHub Actions in .github/workflows to full-length commit SHAs with version comments. A mutable tag can be re-pointed after review, so pinning to a commit SHA is the OpenSSF Scorecard Pinned-Dependencies control. Ref-pinning only, same versions, no functional change. Generated with pinact; each SHA verified to resolve to its version tag. Signed-off-by: AlgoVoi --- .github/workflows/conventional-commits.yml | 2 +- .github/workflows/docs.yml | 6 +++--- .github/workflows/linter.yaml | 4 ++-- .github/workflows/release-please.yml | 2 +- .github/workflows/spellcheck.yaml | 4 ++-- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/conventional-commits.yml b/.github/workflows/conventional-commits.yml index b311e985..c58ab8e3 100644 --- a/.github/workflows/conventional-commits.yml +++ b/.github/workflows/conventional-commits.yml @@ -19,7 +19,7 @@ jobs: runs-on: ubuntu-latest steps: - name: semantic-pull-request - uses: amannn/action-semantic-pull-request@v6 + uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index ed0aeda6..4edddf11 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -29,7 +29,7 @@ jobs: steps: - name: Checkout Code - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: token: ${{ secrets.GITHUB_TOKEN }} fetch-depth: 0 @@ -40,12 +40,12 @@ jobs: git config --global user.email 41898282+github-actions[bot]@users.noreply.github.com - name: Setup Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: 3.13 - name: Restore pip cache - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements-docs.txt') }} path: ~/.cache/pip diff --git a/.github/workflows/linter.yaml b/.github/workflows/linter.yaml index fea1b9c1..45757bed 100644 --- a/.github/workflows/linter.yaml +++ b/.github/workflows/linter.yaml @@ -11,12 +11,12 @@ jobs: steps: - name: Checkout Code - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: fetch-depth: 0 - name: Lint Code Base - uses: super-linter/super-linter/slim@v8 + uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0 env: DEFAULT_BRANCH: main GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 91a4196e..dcc972e6 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -14,7 +14,7 @@ jobs: release-please: runs-on: ubuntu-latest steps: - - uses: googleapis/release-please-action@v4 + - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1 with: token: ${{ secrets.BOT_TOKEN }} release-type: simple diff --git a/.github/workflows/spellcheck.yaml b/.github/workflows/spellcheck.yaml index 90ba7b0d..fb77b4ae 100644 --- a/.github/workflows/spellcheck.yaml +++ b/.github/workflows/spellcheck.yaml @@ -9,7 +9,7 @@ jobs: contents: read actions: read steps: - - uses: actions/checkout@v4 - - uses: streetsidesoftware/cspell-action@v7 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: streetsidesoftware/cspell-action@76c6f6d52abd57f4bcab5f3fde1bbd4f19a99eb0 # v7.2.1 with: incremental_files_only: true From c041b4b8abed8f73dfa8f7361505f39d961800db Mon Sep 17 00:00:00 2001 From: AlgoVoi Date: Wed, 7 Oct 2026 06:11:25 +0100 Subject: [PATCH 2/2] ci(linter): add least-privilege permissions and persist-credentials to Lint workflow The Lint Code Base workflow had no permissions: block, so zizmor's excessive-permissions audit flagged it. Add a top-level block scoped to what super-linter uses (contents: read for checkout, statuses: write for its MULTI_STATUS commit-status posting), and set persist-credentials: false on actions/checkout (zizmor artipacked) since the linter only reads the tree and posts via GITHUB_TOKEN. No lint coverage change: all VALIDATE_* settings and FILTER_REGEX_EXCLUDE are unchanged. Signed-off-by: AlgoVoi --- .github/workflows/linter.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/linter.yaml b/.github/workflows/linter.yaml index 45757bed..aab6b551 100644 --- a/.github/workflows/linter.yaml +++ b/.github/workflows/linter.yaml @@ -4,6 +4,10 @@ on: pull_request: branches: [main] +permissions: + contents: read + statuses: write + jobs: build: name: Lint Code Base @@ -14,6 +18,7 @@ jobs: uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: fetch-depth: 0 + persist-credentials: false - name: Lint Code Base uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0