This repository was archived by the owner on Aug 5, 2026. It is now read-only.
ci: declare explicit workflow permissions and pin actions to commit SHAs - #52
Merged
Merged
Conversation
…_integration.yml VULNMGMT-1068 / VULNMGMT-1069
VULNMGMT-1068 / VULNMGMT-1069
The workflow-level default was contents: write, which inverts the goal of this PR: any job added to this workflow later would silently inherit write. The build-deploy job already declares contents: write at job level, and job-level permissions override workflow-level, so quarto's gh-pages push is unaffected. Only the inherited default changes.
paul-abb
force-pushed
the
security/workflow-permissions-and-sha-pinning
branch
from
August 5, 2026 01:00
66f6b7e to
ea464e4
Compare
paul-abb
changed the title
The pins in this branch were taken at whatever major each workflow already used: checkout v2 and setup-python v2 in continuous_integration.yml, and checkout v3 in publish.yml. Pinning to a commit freezes that exact code permanently, so pinning an old major is worse than the floating tag it replaced -- a floating @v2 still picks up v2 patch and security releases, whereas the pinned commit picks up nothing and has no upgrade path except a manual edit. The runners already warn that the Node 20 runtime these actions use is being deprecated, so the frozen pins would eventually fail closed. checkout -> 11d5960a326750d5838078e36cf38b85af677262 (v4, v4.4.0) setup-python -> a26af69be951a213d495a4c3e4e4022e16d87065 (v5, v5.6.0) Both SHAs were checked against the upstream tag refs rather than copied from a comment. The setup-python bump is safe for this matrix specifically: the YAML-float hazard where an unquoted 3.10 parses as 3.1 applies to 3.10 and above, and this matrix is [3.9].
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Declares explicit
permissions:on both workflows and pins every action to acommit SHA.
Changes
Explicit
permissions:— neither workflow declared one, so every jobinherited the repository default. Sized per workflow by reading what each
actually does rather than applied uniformly:
continuous_integration.ymlcontents: readon: [pull_request], read-onlypublish.ymlcontents: read, job-levelcontents: writequarto publishpushes the rendered site togh-pages; the default stays read-only so any job added later starts least-privilegedAll
uses:refs pinned to commit SHAs, each with a trailing version commentso readability and Renovate/Dependabot updates are preserved. A mutable tag can
be repointed by whoever controls the action repo; a SHA can't.
Action majors raised. Pinning
checkout@v2/setup-python@v2at theircurrent commits would have frozen those majors permanently, with no upgrade path
— which is arguably worse than a floating tag that still receives patches. So
they're raised as part of the same change:
actions/checkout(CI)11d5960a, v4.4.0)actions/setup-python(CI)a26af69b, v5.6.0)actions/checkout(publish)11d5960a, v4.4.0)python-versionis3.9, so thesetup-pythonv5 YAML-float quoting issue(which affects 3.10+) doesn't apply here.
Validation
yaml.safe_load).uses:refs remain — re-grepped for anything not@<40-hex>.each action repo's own tag list for the commit — not assumed from the tag name.
permissions:blocks confirmed parsed at the correct scope.Note on CI status
This repo's CI is red for reasons that predate this PR — the
projectqwheelbuild fails against modern setuptools, and
test_linq_basics_notebookneedspennylane. Neither is touched here. The comparison that matters: the runbefore the action-major bump and the run after it fail identically.