chore(ci): harden github actions#4
Conversation
|
@copilot resolve the merge conflicts in this pull request |
Resolved in 4d33e62. I merged the latest |
There was a problem hiding this comment.
Pull request overview
Hardens the repository’s GitHub Actions workflows by minimizing default GITHUB_TOKEN privileges and pinning third-party action references to immutable commit SHAs to reduce supply-chain risk.
Changes:
- Set workflow-level
permissions: {}and add job-scoped token permissions. - Pin all
uses:action references to full commit SHAs (with version comments). - Adjust
actions/setup-nodeconfiguration to disable package-manager caching.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
.github/workflows/test.yml |
Restricts token permissions, pins actions to SHAs, and changes Node setup caching configuration for CI tests. |
.github/workflows/release.yml |
Moves token permissions to job scope, pins actions to SHAs, and changes Node setup caching configuration for publishing. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
## Summary - Set the v18 release workflow npm dist-tag to `latest-v18`. - Pin GitHub Actions in v18 workflows to commit hashes, matching the hardening style from #4. - Move release permissions to the job scope and disable implicit setup-node package manager cache. ## Testing - `git diff --check` - `rg -n "uses: .*@v[0-9]" .github/workflows` returns no matches
Summary
permissions: {}and job-scoped token permissions.actions/setup-nodeviapackage-manager-cache: false.Validation
git diff --check.github/workflows/test.ymland.github/workflows/release.ymluses: ...@v*action referencesNo repository
preflightscript is defined, so targeted workflow checks were used.