From 340efa447b122e3cb3df4758883c3d798ef5f729 Mon Sep 17 00:00:00 2001 From: Matt Hammond Date: Tue, 26 May 2026 12:47:57 +0100 Subject: [PATCH 1/3] ci: disable credential persistence on checkout Prevents the default GITHUB_TOKEN from being left in the local git config after actions/checkout, so subsequent steps cannot inadvertently reuse it. --- .github/workflows/check.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml index 6069483..a4750bb 100644 --- a/.github/workflows/check.yaml +++ b/.github/workflows/check.yaml @@ -11,6 +11,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 + with: + persist-credentials: false - uses: actions/setup-node@v2 with: From 7e814816cf88df71c5cbbc0a40fa89652ea143af Mon Sep 17 00:00:00 2001 From: Matt Hammond Date: Tue, 26 May 2026 12:48:07 +0100 Subject: [PATCH 2/3] ci: scope workflow permissions explicitly Sets a top-level permissions: {} so the GITHUB_TOKEN starts with no scopes, and grants the check job only the contents: read scope it needs to clone and lint the repository. --- .github/workflows/check.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml index a4750bb..cd71ec9 100644 --- a/.github/workflows/check.yaml +++ b/.github/workflows/check.yaml @@ -6,9 +6,13 @@ on: branches: - main +permissions: {} + jobs: check: runs-on: ubuntu-latest + permissions: + contents: read steps: - uses: actions/checkout@v2 with: From b658326832e8df48f9a73875e6f072ef390a7fda Mon Sep 17 00:00:00 2001 From: Matt Hammond Date: Tue, 26 May 2026 12:48:17 +0100 Subject: [PATCH 3/3] ci: pin third-party actions to commit SHAs Pins actions/checkout and actions/setup-node to the commit SHA each tag currently resolves to, with the tag preserved as a trailing comment so the intent stays readable. Prevents an upstream tag move from silently changing what runs in CI. --- .github/workflows/check.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml index cd71ec9..ed6bad7 100644 --- a/.github/workflows/check.yaml +++ b/.github/workflows/check.yaml @@ -14,11 +14,11 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 with: persist-credentials: false - - uses: actions/setup-node@v2 + - uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2 with: node-version: '16'