Skip to content

Fix GitHub workflow permissions problems flagged by security scanner #1117

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mhucka wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Fix GitHub workflow permissions problems flagged by security scanner #1117

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
95cbe09
Fix workflow vulnerabilities flagged by security scanner
mhucka Oct 11, 2026
9c2ad21
Fix wrong variable name
mhucka Oct 11, 2026
ee7149a
Merge branch 'master' into fix-zizmor-issues
mhucka Oct 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion .github/workflows/ci-nightly-build-test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,8 @@ concurrency:
cancel-in-progress: true
group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}

permissions: read-all
permissions:
contents: read

defaults:
run:
Expand All @@ -85,6 +86,7 @@ jobs:
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
sparse-checkout: .
persist-credentials: false

- name: Get number of commits in the last 24 hrs
id: commits
Expand All @@ -102,6 +104,8 @@ jobs:
steps:
- name: Check out a copy of the TFQ git repository
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false

- name: Set up Python ${{inputs.py_version || env.py_version}}
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
Expand Down
19 changes: 13 additions & 6 deletions .github/workflows/ci-nightly-cirq-test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,7 +83,8 @@ concurrency:
cancel-in-progress: true
group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}

permissions: read-all
permissions:
contents: read

jobs:
test-compatibility:
Expand All @@ -92,6 +93,8 @@ jobs:
steps:
- name: Check out a copy of the TFQ git repository
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false

- name: Set up Python ${{inputs.py_version || env.py_version}}
id: python
Expand All @@ -113,24 +116,28 @@ jobs:
pip install --upgrade cirq~=1.0.dev

- name: Configure Bazel options
env:
CACHE_HIT: ${{steps.python.outputs.cache-hit}}
USE_TEST_CACHE: ${{github.event.inputs.use_test_cache}}
USE_DISK_CACHE: ${{github.event.inputs.use_disk_cache}}
run: |
# If we didn't get a cache hit on the installed Python environment,
# something's changed, and we want to make sure to re-run all tests.
if [[ "${{steps.python.outputs.cache-hit}}" == "true"
&& "${{github.event.inputs.use_test_cache}}" != "false" ]]; then
if [[ "$CACHE_HIT" == "true"
&& "$USE_TEST_CACHE" != "false" ]]; then
echo "use_test_cache=auto" >> "$GITHUB_ENV"
else
echo "use_test_cache=no" >> "$GITHUB_ENV"
fi
# Use the disk cache unless told not to.
if [[ "${{github.event.inputs.use_disk_cache}}" != "false" ]]; then
if [[ "$USE_DISK_CACHE" != "false" ]]; then
echo "use_disk_cache=true" >> "$GITHUB_ENV"
else
echo "use_disk_cache=false" >> "$GITHUB_ENV"
fi

- name: Set up Bazel with caching
if: env.use_bazel_disk_cache == 'true'
if: env.use_disk_cache == 'true'
uses: bazel-contrib/setup-bazel@c5acdfb288317d0b5c0bbd7a396a3dc868bb0f86 # 0.19.0
env:
USE_BAZEL_VERSION: ${{inputs.bazel_version || env.bazel_version}}
Expand All @@ -144,7 +151,7 @@ jobs:
test --cache_test_results=${{env.use_test_cache}}

- name: Set up Bazel without caching
if: env.use_bazel_disk_cache == 'false'
if: env.use_disk_cache == 'false'
uses: bazel-contrib/setup-bazel@c5acdfb288317d0b5c0bbd7a396a3dc868bb0f86 # 0.19.0
env:
USE_BAZEL_VERSION: ${{inputs.bazel_version || env.bazel_version}}
Expand Down
10 changes: 9 additions & 1 deletion .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,8 @@ concurrency:
cancel-in-progress: true
group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}

permissions: read-all
permissions:
contents: read

jobs:
format-and-lint-checks:
Expand All @@ -46,6 +47,7 @@ jobs:
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
fetch-depth: 0
persist-credentials: false

- name: Set up Python
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
Expand All @@ -71,6 +73,8 @@ jobs:
timeout-minutes: 60
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
with:
python-version: ${{env.python-version}}
Expand Down Expand Up @@ -100,6 +104,8 @@ jobs:
# This file, though it's empty, hangs the Bazel install step.
rm -f /etc/bazel.bazelrc
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
with:
python-version: ${{env.python-version}}
Expand Down Expand Up @@ -151,6 +157,8 @@ jobs:
# This file, though it's empty, hangs the Bazel install step.
rm -f /etc/bazel.bazelrc
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
with:
python-version: ${{env.python-version}}
Expand Down
Loading