ci: bump actions/setup-python from 6.3.0 to 7.0.0 #298
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: fork-pr-isolation | |
| # Blue-team guard: prove that a fork PR can never reach a secret / writable token / | |
| # self-hosted runner / unpinned action / pull_request_target-pwn-request / workflow_run | |
| # artifact-injection. Runs on every PR and push to main so a workflow change that opens a | |
| # fork-exfiltration vector fails here before it lands. | |
| # The guard runs its own anti-tautology selfcheck first: a broken guard can't pass silently. | |
| # | |
| # NOTE (updated 2026-07-12): this check IS a required status check on `main`. The ruleset | |
| # `protect-main` lists `guard` under required_status_checks (verified via | |
| # `gh api repos/b7n0de/proofbundle/rules/branches/main`), so a red run here blocks the merge. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| guard: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Install PyYAML (guard dependency) | |
| run: python -m pip install "pyyaml>=6" | |
| - name: Detector self-check (anti-tautology — must have teeth) | |
| run: python scripts/fork_pr_secret_isolation.py --selfcheck | |
| - name: Fork-PR secret-isolation invariant | |
| run: python scripts/fork_pr_secret_isolation.py --dir .github/workflows |