From 95cbe09285770d4825e163c2ba32b1e93ad21ed4 Mon Sep 17 00:00:00 2001 From: mhucka Date: Sun, 11 Oct 2026 23:05:59 +0000 Subject: [PATCH 1/2] Fix workflow vulnerabilities flagged by security scanner This fixes permissions-related issues flagged by Google's workflow security scanner. --- .github/workflows/ci-nightly-build-test.yaml | 6 +++++- .github/workflows/ci-nightly-cirq-test.yaml | 15 +++++++++++---- .github/workflows/ci.yaml | 10 +++++++++- 3 files changed, 25 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci-nightly-build-test.yaml b/.github/workflows/ci-nightly-build-test.yaml index 2dda68e2a..845c20afe 100644 --- a/.github/workflows/ci-nightly-build-test.yaml +++ b/.github/workflows/ci-nightly-build-test.yaml @@ -69,7 +69,8 @@ concurrency: cancel-in-progress: true group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}} -permissions: read-all +permissions: + contents: read defaults: run: @@ -85,6 +86,7 @@ jobs: uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: sparse-checkout: . + persist-credentials: false - name: Get number of commits in the last 24 hrs id: commits @@ -102,6 +104,8 @@ jobs: steps: - name: Check out a copy of the TFQ git repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Set up Python ${{inputs.py_version || env.py_version}} uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 diff --git a/.github/workflows/ci-nightly-cirq-test.yaml b/.github/workflows/ci-nightly-cirq-test.yaml index 40c3a4748..3d7320774 100644 --- a/.github/workflows/ci-nightly-cirq-test.yaml +++ b/.github/workflows/ci-nightly-cirq-test.yaml @@ -83,7 +83,8 @@ concurrency: cancel-in-progress: true group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}} -permissions: read-all +permissions: + contents: read jobs: test-compatibility: @@ -92,6 +93,8 @@ jobs: steps: - name: Check out a copy of the TFQ git repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Set up Python ${{inputs.py_version || env.py_version}} id: python @@ -113,17 +116,21 @@ jobs: pip install --upgrade cirq~=1.0.dev - name: Configure Bazel options + env: + CACHE_HIT: ${{steps.python.outputs.cache-hit}} + USE_TEST_CACHE: ${{github.event.inputs.use_test_cache}} + USE_DISK_CACHE: ${{github.event.inputs.use_disk_cache}} run: | # If we didn't get a cache hit on the installed Python environment, # something's changed, and we want to make sure to re-run all tests. - if [[ "${{steps.python.outputs.cache-hit}}" == "true" - && "${{github.event.inputs.use_test_cache}}" != "false" ]]; then + if [[ "$CACHE_HIT" == "true" + && "$USE_TEST_CACHE" != "false" ]]; then echo "use_test_cache=auto" >> "$GITHUB_ENV" else echo "use_test_cache=no" >> "$GITHUB_ENV" fi # Use the disk cache unless told not to. - if [[ "${{github.event.inputs.use_disk_cache}}" != "false" ]]; then + if [[ "$USE_DISK_CACHE" != "false" ]]; then echo "use_disk_cache=true" >> "$GITHUB_ENV" else echo "use_disk_cache=false" >> "$GITHUB_ENV" diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 7c61107f1..f83bc8c69 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -34,7 +34,8 @@ concurrency: cancel-in-progress: true group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}} -permissions: read-all +permissions: + contents: read jobs: format-and-lint-checks: @@ -46,6 +47,7 @@ jobs: uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 + persist-credentials: false - name: Set up Python uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 @@ -71,6 +73,8 @@ jobs: timeout-minutes: 60 steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{env.python-version}} @@ -100,6 +104,8 @@ jobs: # This file, though it's empty, hangs the Bazel install step. rm -f /etc/bazel.bazelrc - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{env.python-version}} @@ -151,6 +157,8 @@ jobs: # This file, though it's empty, hangs the Bazel install step. rm -f /etc/bazel.bazelrc - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{env.python-version}} From 9c2ad21ff66040624646092cfda6c38512d0d40a Mon Sep 17 00:00:00 2001 From: mhucka Date: Sun, 11 Oct 2026 23:08:33 +0000 Subject: [PATCH 2/2] Fix wrong variable name --- .github/workflows/ci-nightly-cirq-test.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci-nightly-cirq-test.yaml b/.github/workflows/ci-nightly-cirq-test.yaml index 3d7320774..4ac17617a 100644 --- a/.github/workflows/ci-nightly-cirq-test.yaml +++ b/.github/workflows/ci-nightly-cirq-test.yaml @@ -137,7 +137,7 @@ jobs: fi - name: Set up Bazel with caching - if: env.use_bazel_disk_cache == 'true' + if: env.use_disk_cache == 'true' uses: bazel-contrib/setup-bazel@c5acdfb288317d0b5c0bbd7a396a3dc868bb0f86 # 0.19.0 env: USE_BAZEL_VERSION: ${{inputs.bazel_version || env.bazel_version}} @@ -151,7 +151,7 @@ jobs: test --cache_test_results=${{env.use_test_cache}} - name: Set up Bazel without caching - if: env.use_bazel_disk_cache == 'false' + if: env.use_disk_cache == 'false' uses: bazel-contrib/setup-bazel@c5acdfb288317d0b5c0bbd7a396a3dc868bb0f86 # 0.19.0 env: USE_BAZEL_VERSION: ${{inputs.bazel_version || env.bazel_version}}