Skip to content

harden(ci): SHA-pin actions, scope permissions, add dependabot cooldown #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
marcohost33-maker merged 1 commit into from
May 24, 2026
Merged

harden(ci): SHA-pin actions, scope permissions, add dependabot cooldown #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,10 @@ updates:
day: "monday"
time: "06:00"
timezone: "Europe/Zurich"
# Cooldown: ignore releases younger than N days, so a just-published
# (possibly compromised) version is not pulled in immediately. (zizmor: dependabot-cooldown)
cooldown:
default-days: 7
open-pull-requests-limit: 8
groups:
react:
Expand Down Expand Up @@ -50,6 +54,9 @@ updates:
day: "monday"
time: "06:00"
timezone: "Europe/Zurich"
# Cooldown: ignore releases younger than N days. (zizmor: dependabot-cooldown)
cooldown:
default-days: 7
open-pull-requests-limit: 5
groups:
actions-minor-and-patch:
Expand Down
13 changes: 10 additions & 3 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,19 +5,26 @@ on:
branches: [main]
pull_request:

# Least privilege at the top level; jobs opt back in to only what they need.
permissions: {}

jobs:
test:
name: pytest (Python ${{ matrix.python-version }})
runs-on: ubuntu-latest
permissions:
contents: read # checkout only; upload-artifact uses the Actions runtime token
strategy:
fail-fast: false
matrix:
python-version: ["3.9", "3.10", "3.11", "3.12"]
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false

- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v5
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with:
python-version: ${{ matrix.python-version }}
cache: pip
Expand All @@ -33,7 +40,7 @@ jobs:

- name: Upload coverage artifact
if: matrix.python-version == '3.11'
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: coverage-xml
path: coverage.xml
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/zizmor.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ jobs:
# upload failing on private repos without GitHub Advanced Security.
if: ${{ !cancelled() && hashFiles('zizmor.sarif') != '' }}
continue-on-error: true
uses: github/codeql-action/upload-sarif@f411752efdf656cb71aa17b755b22c890960da1d # v3.35.5
uses: github/codeql-action/upload-sarif@458d36d7d4f47d0dd16ca424c1d3cda0060f1360 # v3.35.5
with:
sarif_file: zizmor.sarif
category: zizmor
Loading