Skip to content

Harden GitHub Actions workflows and pin actions#766

Open
jder wants to merge 3 commits into
mainfrom
codex/ci-hardening
Open

Harden GitHub Actions workflows and pin actions#766
jder wants to merge 3 commits into
mainfrom
codex/ci-hardening

Conversation

@jder

@jder jder commented Jun 17, 2026

Copy link
Copy Markdown
Member

Summary

  • Narrow workflow and job-level permissions to the minimum required for each CI path
  • Pin third-party GitHub Actions to commit SHAs across test, benchmark, pages, and container workflows
  • Keep benchmark publishing and GHCR publishing permissions scoped to the jobs that need them

Testing

  • Not run (not requested)

@jder

jder commented Jun 17, 2026

Copy link
Copy Markdown
Member Author

@codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Something went wrong. Try again later by commenting “@codex review”.

Repository could not be found
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@jder

jder commented Jun 17, 2026

Copy link
Copy Markdown
Member Author

@codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Something went wrong. Try again later by commenting “@codex review”.

Repository could not be found
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant