From 74b6b05a4075eb6a42aa487b718cf40bd5f8b65c Mon Sep 17 00:00:00 2001 From: Eden Zimbelman Date: Thu, 27 Aug 2026 00:54:43 -0700 Subject: [PATCH 1/2] =?UTF-8?q?ci:=20harden=20workflows=20=E2=80=94=20pin?= =?UTF-8?q?=20actions=20to=20SHAs,=20scope=20permissions?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Address zizmor findings in the Test workflow: - Pin actions to full-length commit SHAs (2x High unpinned-uses) - Add least-privilege top-level permissions: contents: read (Medium) - Set persist-credentials: false on checkout (Low artipacked) Co-Authored-By: Claude --- .github/workflows/test.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 8ed5859..f72d42b 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -4,6 +4,8 @@ on: branches: - main pull_request: +permissions: + contents: read jobs: test: name: "pytest@python3.14" @@ -19,9 +21,11 @@ jobs: - "methods" steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Install Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.14" - name: Run tests From 11a3b9919b8def41c0d5178e36fcf6e6ac35f58e Mon Sep 17 00:00:00 2001 From: Eden Zimbelman Date: Thu, 27 Aug 2026 00:57:24 -0700 Subject: [PATCH 2/2] ci: scope permissions to the job rather than workflow top level Co-Authored-By: Claude --- .github/workflows/test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index f72d42b..3503800 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -4,12 +4,12 @@ on: branches: - main pull_request: -permissions: - contents: read jobs: test: name: "pytest@python3.14" runs-on: ubuntu-latest + permissions: + contents: read strategy: fail-fast: false matrix: