From 62a9ff5e5d24f649a372fa8980b46fa402083ba8 Mon Sep 17 00:00:00 2001 From: Open Source Santander AI Date: Wed, 8 Jul 2026 12:13:24 +0200 Subject: [PATCH] security: genericize internal-pattern regexes and pin release action by SHA - pattern-check.yml: replace environment-specific hostname fragments with a generic, non-attributable '.corp' TLD pattern. - release.yml: pin pypa/gh-action-pypi-publish (commented Trusted Publishing job) to the v1.14.0 commit SHA so it is already pinned whenever the job is enabled. No behavior change. --- .github/workflows/pattern-check.yml | 3 +-- .github/workflows/release.yml | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/pattern-check.yml b/.github/workflows/pattern-check.yml index 1112e4c..84df1ce 100644 --- a/.github/workflows/pattern-check.yml +++ b/.github/workflows/pattern-check.yml @@ -57,10 +57,9 @@ jobs: # Internal hostnames / TLDs '\.corp\.santander\.com' '\.intranet\.santander\.com' - 'cloudcenter\.corp' + '\.corp\b' # Internal Artifactory / registries 'artifactory\.santander\.' - 'nexus\.alm\.' ) PATTERN_ERE=$(IFS='|'; echo "${PATTERNS[*]}") diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index dd6cc8e..867ed5e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -62,4 +62,4 @@ jobs: # name: dist # path: dist/ # - name: Publish - # uses: pypa/gh-action-pypi-publish@release/v1 + # uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0