From 76db2c36d29026f0781753c8dac220ed63f6835a Mon Sep 17 00:00:00 2001 From: jhamon Date: Sat, 11 Jul 2026 16:20:45 -0400 Subject: [PATCH] ci: pin claude-code-action to SHA + restrict contextualize to same-repo PRs (CodeQL) - Pin anthropics/claude-code-action@v1 -> @e90deca # v1.0.171 in both contextualize-skills.yml and claude.yml. Fixes 2x actions/unpinned-tag. - Harden contextualize-skills against actions/untrusted-checkout: the job checks out the PR head and runs Claude Code over it WITH the ANTHROPIC_API_KEY secret, contents: write, and pull-requests: write, then pushes commits back. Add an explicit `head.repo.full_name == github.repository` guard so a fork PR can never reach this privileged, secret-bearing path. Combined with the existing sync/skills- branch filter, only the internal skills-sync automation triggers it. claude.yml was already least-privilege (contents: read; gated on author_association OWNER/MEMBER/COLLABORATOR) and needed only the pin. The 2 untrusted-checkout alerts are dismissed (won't fix) with this compensating control as the documented reason. Refs PIN-24. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/claude.yml | 2 +- .github/workflows/contextualize-skills.yml | 12 ++++++++++-- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 97ad847..a28235b 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -32,7 +32,7 @@ jobs: - name: Run Claude Code id: claude - uses: anthropics/claude-code-action@v1 + uses: anthropics/claude-code-action@e90deca47693f9457b72f2b53c17d7c445a87342 # v1.0.171 with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} diff --git a/.github/workflows/contextualize-skills.yml b/.github/workflows/contextualize-skills.yml index 47a8159..349bd99 100644 --- a/.github/workflows/contextualize-skills.yml +++ b/.github/workflows/contextualize-skills.yml @@ -6,7 +6,15 @@ on: jobs: contextualize: - if: startsWith(github.head_ref, 'sync/skills-') + # Hardening (CodeQL actions/untrusted-checkout): this job checks out the PR + # head and runs Claude Code over it WITH secrets (ANTHROPIC_API_KEY), + # contents: write, and pull-requests: write, then pushes commits back. + # Restrict it to same-repo PRs so a fork PR can never reach this + # privileged, secret-bearing path. Combined with the sync/skills- branch + # filter, only the internal skills-sync automation can trigger it. + if: >- + github.event.pull_request.head.repo.full_name == github.repository && + startsWith(github.head_ref, 'sync/skills-') runs-on: ubuntu-latest permissions: @@ -32,7 +40,7 @@ jobs: - name: Run Claude Code if: steps.check_author.outputs.skip != 'true' - uses: anthropics/claude-code-action@v1 + uses: anthropics/claude-code-action@e90deca47693f9457b72f2b53c17d7c445a87342 # v1.0.171 with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} github_token: ${{ github.token }}