Skip to content

ci: harden GitHub Actions workflows#185

Merged
flavorjones merged 8 commits intomainfrom
harden-github-actions
Mar 20, 2026
Merged

ci: harden GitHub Actions workflows#185
flavorjones merged 8 commits intomainfrom
harden-github-actions

Conversation

@flavorjones
Copy link
Copy Markdown
Member

Summary

  • Add zizmor and actionlint CI job
  • Configure dependabot with batched updates and cooldown periods
  • Pin all GitHub Actions to SHA hashes
  • Fix template-injection, excessive-permissions, and artipacked findings
  • Suppress unpinned-images for service containers
  • Scope all permissions to job-level
  • Add local workflow linting to bin/setup and config/ci.rb

Test plan

  • CI passes (lint-actions job runs clean)
  • Existing test and publish jobs unaffected

🤖 Generated with Claude Code

flavorjones and others added 7 commits March 20, 2026 16:34
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Batches all action updates into a single weekly PR. Adds cooldown
periods to all ecosystems.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…nd bin/ci

Install actionlint, shellcheck, and zizmor in bin/setup. Run both
linters as CI steps in config/ci.rb alongside existing style checks.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Run pinact to pin action versions to specific commit SHAs,
preventing supply chain attacks from tag mutation.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Suppress unpinned-images for redis service containers (digest
  pinning is nontrivial for service containers)
- Move workflow-level permissions to job-level in publish-image.yml
  (build gets full set, manifest gets only what it needs)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Add persist-credentials: false to all checkout steps
- Add permissions: {} at workflow level in ci.yml
- Add job-level permissions (contents: read) to all CI jobs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Move steps.meta.outputs.tags from inline ${{ }} expressions to env
vars in both the manifest creation and cosign signing steps.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings March 20, 2026 21:18
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens the repository’s CI/CD posture by introducing GitHub Actions linting/auditing, tightening permissions, and pinning action references to immutable SHAs to reduce supply-chain risk.

Changes:

  • Add GitHub Actions linting/auditing via actionlint + zizmor in both local CI (bin/ci) and GitHub Actions.
  • Harden workflows by scoping permissions to the job level, disabling persisted checkout credentials, and pinning all actions to commit SHAs.
  • Add a Dependabot configuration to batch and schedule updates across ecosystems.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
config/ci.rb Adds local CI steps to run actionlint and zizmor.
bin/setup Attempts to install workflow lint tools locally as part of setup.
.github/workflows/ci.yml Adds a dedicated lint-actions job and hardens existing jobs (permissions, pinned actions, checkout credentials).
.github/workflows/publish-image.yml Hardens image publishing workflow permissions and pins actions to SHAs; small bash/env adjustments.
.github/dependabot.yml Introduces scheduled/batched dependency updates for actions, bundler, and docker.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

bin/brakeman uses --ensure-latest which fails if not on the newest version.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@flavorjones flavorjones merged commit 3fada3d into main Mar 20, 2026
12 checks passed
@flavorjones flavorjones deleted the harden-github-actions branch March 20, 2026 23:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants