ci: harden GitHub Actions workflows#36
Conversation
There was a problem hiding this comment.
Pull request overview
This PR hardens the repository’s GitHub automation by reducing default token permissions, pinning GitHub Actions to immutable SHAs, and adding CI checks to audit workflow security and correctness.
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
Changes:
- Add a dedicated CI job to run
actionlintandzizmoragainst workflows. - Pin referenced GitHub Actions to specific commit SHAs and disable checkout credential persistence.
- Add a new Dependabot configuration to group updates and control update timing.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| .github/workflows/docker-publish.yml | Applies least-privilege permissions and pins actions; adjusts tag derivation to avoid expression interpolation in shell. |
| .github/workflows/ci.yml | Adds a workflow-auditing job and scopes permissions; pins actions used by CI. |
| .github/dependabot.yml | Introduces grouped Dependabot updates for GitHub Actions and Bundler with scheduled cadence. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Move github.event.inputs.tagInput to env var to prevent code injection via template expansion. github.ref_name already available as GITHUB_REF_NAME. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Set permissions: {} at workflow level and scope per-job permissions.
Add persist-credentials: false to all checkout steps.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
flavorjones
force-pushed
the
harden-github-actions
branch
from
6df0344 to
88c6b12
Compare
Add validation that the version tag matches [A-Za-z0-9_.-]{1,128}
before writing to $GITHUB_OUTPUT, preventing newline injection or
invalid Docker tags from workflow_dispatch input.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
First character must be [A-Za-z0-9_] per Docker tag spec. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Summary
Test plan
🤖 Generated with Claude Code