From 3fd0afc3217c50d613d556c6833e0a6022263672 Mon Sep 17 00:00:00 2001 From: Daniel Grimes Date: Wed, 16 Sep 2026 19:57:46 +0000 Subject: [PATCH] chore(ci): pin every action to a commit SHA, and give each workflow a permissions floor A tag is a moving pointer. Anyone who can move it - the action author, or anyone who compromises their account - runs code in this workflow with whatever the job has in scope. A commit SHA cannot be moved. Every uses: in this repo now pins a SHA with the tag kept as a trailing comment, which is the form Dependabot reads, so updates still arrive as pull requests rather than silently. Where a workflow had no top-level permissions: block it now declares contents: read. Jobs that need more still declare their own and override it. The org default is already read, but a default is a setting somebody can widen and a written floor is not. --- .github/workflows/build.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index cc6858f..5b7ab55 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -42,6 +42,12 @@ env: DOCKERFILE: .devcontainer/Dockerfile BUILD_CONTEXT: .devcontainer +# The default for every job below. A job that needs more declares it itself; +# an explicit floor here means a new job cannot silently inherit an org +# setting somebody widened. +permissions: + contents: read + jobs: lint: name: lint