From 1d9446f707c57651719fd895c3891f5600ab6d7a Mon Sep 17 00:00:00 2001
From: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
Date: Fri, 16 Oct 2026 17:34:23 +0000
Subject: [PATCH 1/6] ops: Pin `actions/checkout` to 3.7.0 hash

See: https://github.com/actions/checkout/releases/tag/v3.7.0

This is the same version we are already implicitly using at the time of
writing.

Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
---
 .github/workflows/deploy.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 12f4dd7..e22a3a3 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -9,7 +9,7 @@ jobs:
     name: GitHub Pages
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: Get mdBook
         run: |

From 23b660d3f7edd963b9f5512868c627000602e84b Mon Sep 17 00:00:00 2001
From: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
Date: Fri, 16 Oct 2026 17:36:04 +0000
Subject: [PATCH 2/6] ops: Disable credential persistence

See: https://docs.zizmor.sh/audits/#artipacked

This can lead to accidentally publishing credentials publicly,
especially in versions of `actions/checkout` prior to v6.0.0.

Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
---
 .github/workflows/deploy.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index e22a3a3..9945c2f 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -10,6 +10,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+        with:
+          persist-credentials: false
 
       - name: Get mdBook
         run: |

From 622657da738c355c4fe38b977c39f9913cfd68ed Mon Sep 17 00:00:00 2001
From: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
Date: Fri, 16 Oct 2026 17:39:26 +0000
Subject: [PATCH 3/6] ops: Expand `github.repository` in `env`

Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
---
 .github/workflows/deploy.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 9945c2f..152d679 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -33,5 +33,7 @@ jobs:
           git config user.name "Rust API Guidelines"
           git config user.email "libs@rust-lang.org"
           git add -A .
-          git commit -qm "API Guidelines @ ${{github.repository}}@${REV}"
+          git commit -qm "API Guidelines @ ${GH_REPO}@${REV}"
           git push -q upstream HEAD:refs/heads/gh-pages --force
+        env:
+          GH_REPO: ${{github.repository}}

From 06bef9a778128ef5ff006607a4d0e74fc10b1d4a Mon Sep 17 00:00:00 2001
From: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
Date: Fri, 16 Oct 2026 17:41:09 +0000
Subject: [PATCH 4/6] ops: Expand `secrets.GITHUB_TOKEN` in `env`

Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
---
 .github/workflows/deploy.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 152d679..e57c41f 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -29,7 +29,7 @@ jobs:
         run: |
           REV=$(git rev-parse --short HEAD)
           git init
-          git remote add upstream https://x-access-token:${{secrets.GITHUB_TOKEN}}@github.com/rust-lang/api-guidelines
+          git remote add upstream "https://x-access-token:${GH_TOKEN}@github.com/rust-lang/api-guidelines"
           git config user.name "Rust API Guidelines"
           git config user.email "libs@rust-lang.org"
           git add -A .
@@ -37,3 +37,4 @@ jobs:
           git push -q upstream HEAD:refs/heads/gh-pages --force
         env:
           GH_REPO: ${{github.repository}}
+          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}

From cbffbcf35049f4f60cb8e166604cea5e36e89463 Mon Sep 17 00:00:00 2001
From: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
Date: Fri, 16 Oct 2026 17:43:12 +0000
Subject: [PATCH 5/6] ops: Disable all permissions by default

Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
---
 .github/workflows/deploy.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index e57c41f..798e6d4 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -4,6 +4,8 @@ on:
   push:
   pull_request:
 
+permissions: {}
+
 jobs:
   publish:
     name: GitHub Pages

From 04e06c2db5b806f1ba472408e0fd124726ef5c59 Mon Sep 17 00:00:00 2001
From: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
Date: Fri, 16 Oct 2026 17:45:38 +0000
Subject: [PATCH 6/6] ops: Grant minimum required permissions

Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
---
 .github/workflows/deploy.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 798e6d4..64d871a 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -10,6 +10,8 @@ jobs:
   publish:
     name: GitHub Pages
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # Required for `git push`
     steps:
       - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
         with: