From eaef9a753f05e05d165e19d2d557a3a538d2fb13 Mon Sep 17 00:00:00 2001 From: Jon Rowe Date: Fri, 4 Sep 2026 10:35:03 +0100 Subject: [PATCH 1/4] Pin actions to SHA --- .github/workflows/build.yml | 10 +++++----- .github/workflows/middleman_deploy.yml | 14 +++++++------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 332cc81d..a5410107 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -17,19 +17,19 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup bundler cache - uses: actions/cache@v3 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: key: ${{ runner.os }}-bundler-${{ hashFiles('Gemfile.lock') }} path: .bundle/gems - name: Setup build cache - uses: actions/cache@v3 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: key: ${{ runner.os }}-build path: __build - name: Setup Ruby - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 with: ruby-version: '3.3' - name: Install dependencies @@ -43,7 +43,7 @@ jobs: BUILD_OUTPUT="__build" bundle exec middleman build - name: Generate HTML Preview id: html_preview - uses: pavi2410/html-preview-action@v2 + uses: pavi2410/html-preview-action@b58683c238478d5f8b5dacf4fe5e3f403afb449a # v5 with: html_file: '__build/index.html' - name: Access preview diff --git a/.github/workflows/middleman_deploy.yml b/.github/workflows/middleman_deploy.yml index 9f7c3824..294bd47f 100644 --- a/.github/workflows/middleman_deploy.yml +++ b/.github/workflows/middleman_deploy.yml @@ -30,20 +30,20 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Pages - uses: actions/configure-pages@v4 + uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 - name: Setup Ruby - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 with: ruby-version: '3.3' - name: Setup bundler cache - uses: actions/cache@v3 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: key: ${{ runner.os }}-bundler-${{ hashFiles('Gemfile.lock') }} path: .bundle/gems - name: Setup build cache - uses: actions/cache@v3 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: key: ${{ runner.os }}-source-build path: __source_build @@ -60,10 +60,10 @@ jobs: if: ${{ github.repository == 'rspec/rspec.github.io' }} run: echo "rspec.info" > CNAME - name: Upload artifact - uses: actions/upload-pages-artifact@v3 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: # Upload entire repository path: '__source_build' - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1 From 5a4c36636e8f20fbc613f33fe653092a97c6554e Mon Sep 17 00:00:00 2001 From: Jon Rowe Date: Fri, 4 Sep 2026 10:48:14 +0100 Subject: [PATCH 2/4] Turn off persist-credentials --- .github/workflows/build.yml | 2 ++ .github/workflows/middleman_deploy.yml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index a5410107..f4f77fa0 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -18,6 +18,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Setup bundler cache uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: diff --git a/.github/workflows/middleman_deploy.yml b/.github/workflows/middleman_deploy.yml index 294bd47f..196317a6 100644 --- a/.github/workflows/middleman_deploy.yml +++ b/.github/workflows/middleman_deploy.yml @@ -31,6 +31,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Setup Pages uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 - name: Setup Ruby From 1b8885f87c7d26a2bd3c5b6c519dfd4c493105e7 Mon Sep 17 00:00:00 2001 From: Jon Rowe Date: Fri, 4 Sep 2026 10:49:11 +0100 Subject: [PATCH 3/4] Refactor output url --- .github/workflows/build.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index f4f77fa0..219c3bf6 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -49,4 +49,6 @@ jobs: with: html_file: '__build/index.html' - name: Access preview - run: echo "${{steps.html_preview.outputs.url}}" + run: echo "${STEPS_HTML_PREVIEW_OUTPUTS_URL}" + env: + STEPS_HTML_PREVIEW_OUTPUTS_URL: ${{steps.html_preview.outputs.url}} From d0c13bdb84f267dce0c7de9180241d0150790365 Mon Sep 17 00:00:00 2001 From: Jon Rowe Date: Fri, 4 Sep 2026 10:49:46 +0100 Subject: [PATCH 4/4] Set permissions for build to content read --- .github/workflows/build.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 219c3bf6..95b3f574 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -12,6 +12,9 @@ concurrency: group: "pages" cancel-in-progress: false +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest