zi0Black
|
265af8a183
|
ci: harden GitHub Actions workflows (zizmor audit)
- Pin all unpinned action refs to immutable commit SHAs (tag
immutability verified via GitHub rulesets API for each repo;
all returned false/empty so SHA pinning applied)
- Add top-level `permissions: contents: read` to ci.yml, test.yml,
and validate.yml (publish.yml already had per-job permissions)
- Add `persist-credentials: false` to all actions/checkout steps
to prevent credential leakage through GitHub Actions artifacts
Findings addressed: unpinned-uses (40 errors), excessive-permissions
(27 warnings), artipacked (26 warnings) — 93 findings total
Actions pinned:
actions/checkout v4 -> 34e114876b0b11c390a56381ad16ebd13914f8d5
actions/publish-immutable-action v0.0.4 -> 4bc8754ffc40f27910afb20287dbbbb675a4e978
docker/setup-qemu-action v3 -> c7c53464625b32c7a7e944ae62b3e17d2b600130
docker/build-push-action v6 -> 10e90e3645eae34f1e60eeb005ba3a3d33f178e8
docker/build-push-action master -> 789f68658055d3ca993799b232b5c46dfe3f114d
docker/bake-action v5 -> 4a9a8d494466d37134e2bfca2d3a8de8fb2681ad
crazy-max/ghaction-dump-context v2 -> 5355a8e5e6ac5a302e746a1c4b7747a0393863c8
codecov/codecov-action v4 -> b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238
crazy-max/.github install-k3s -> already SHA-pinned (skipped)
|
2026-05-14 00:34:57 +02:00 |
|