From ac1216825e52d0ad766138f485429f3db04e296f Mon Sep 17 00:00:00 2001 From: Brian Anglin Date: Wed, 11 Nov 2026 22:34:26 -0800 Subject: [PATCH] ci: pin actions to commit SHAs and declare GITHUB_TOKEN permissions The superwall org is turning on "require actions to be pinned to a full-length commit SHA" and a read-only default GITHUB_TOKEN. - Pin every non-local `uses:` (actions, reusable workflows, composite action internals) to the commit its current tag or branch resolves to, keeping the version as a trailing comment. No version changes. - Add explicit `permissions:` to workflows that relied on the org's read/write default, granting only the scopes each job uses today. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/deploy.yml | 7 +++++-- .github/workflows/duplicate-issues.yml | 2 +- .github/workflows/guidelines-check.yml | 2 +- .github/workflows/notify-discord.yml | 5 ++++- .github/workflows/opencode.yml | 4 ++-- .github/workflows/publish-github-action.yml | 2 +- .github/workflows/publish-vscode.yml | 4 ++-- .github/workflows/publish.yml | 8 ++++---- .github/workflows/stats.yml | 4 ++-- .github/workflows/typecheck.yml | 7 +++++-- 10 files changed, 27 insertions(+), 18 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index a2e69410c8bc..3404dcfc3c84 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -9,13 +9,16 @@ on: concurrency: ${{ github.workflow }}-${{ github.ref }} +permissions: + contents: read + jobs: deploy: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3 - - uses: oven-sh/setup-bun@v1 + - uses: oven-sh/setup-bun@f4d14e03ff726c06358e5557344e1da148b56cf7 # v1 with: bun-version: 1.2.19 diff --git a/.github/workflows/duplicate-issues.yml b/.github/workflows/duplicate-issues.yml index 11f49fb7d990..926766819f35 100644 --- a/.github/workflows/duplicate-issues.yml +++ b/.github/workflows/duplicate-issues.yml @@ -12,7 +12,7 @@ jobs: issues: write steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: fetch-depth: 1 diff --git a/.github/workflows/guidelines-check.yml b/.github/workflows/guidelines-check.yml index b4da51c93a1a..3c54ebc36210 100644 --- a/.github/workflows/guidelines-check.yml +++ b/.github/workflows/guidelines-check.yml @@ -13,7 +13,7 @@ jobs: pull-requests: write steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: fetch-depth: 1 diff --git a/.github/workflows/notify-discord.yml b/.github/workflows/notify-discord.yml index c9032c301eee..4ec775022ef5 100644 --- a/.github/workflows/notify-discord.yml +++ b/.github/workflows/notify-discord.yml @@ -4,11 +4,14 @@ on: release: types: [published] # fires only when a release is published +permissions: + contents: read + jobs: notify: runs-on: ubuntu-latest steps: - name: Send nicely-formatted embed to Discord - uses: SethCohen/github-releases-to-discord@v1 + uses: SethCohen/github-releases-to-discord@24d166886aee4646d448c8a389ff9e1ebcab3682 # v1 with: webhook_url: ${{ secrets.DISCORD_WEBHOOK }} diff --git a/.github/workflows/opencode.yml b/.github/workflows/opencode.yml index 08014cf2cad4..36c6dff2abcb 100644 --- a/.github/workflows/opencode.yml +++ b/.github/workflows/opencode.yml @@ -17,10 +17,10 @@ jobs: issues: read steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Run opencode - uses: sst/opencode/github@latest + uses: sst/opencode/github@77fc88c8ade8e5a620ebbe1197f3a572d29ae91a # latest env: OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }} with: diff --git a/.github/workflows/publish-github-action.yml b/.github/workflows/publish-github-action.yml index cfd14148c3dc..96dfce0ebd5d 100644 --- a/.github/workflows/publish-github-action.yml +++ b/.github/workflows/publish-github-action.yml @@ -16,7 +16,7 @@ jobs: publish: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3 with: fetch-depth: 0 diff --git a/.github/workflows/publish-vscode.yml b/.github/workflows/publish-vscode.yml index 5cb406f68c0c..9fd1bf8dda63 100644 --- a/.github/workflows/publish-vscode.yml +++ b/.github/workflows/publish-vscode.yml @@ -15,11 +15,11 @@ jobs: publish: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3 with: fetch-depth: 0 - - uses: oven-sh/setup-bun@v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 with: bun-version: 1.2.19 diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index cf9c547df89e..72788af7a828 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -23,25 +23,25 @@ jobs: publish: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3 with: fetch-depth: 0 - run: git fetch --force --tags - - uses: actions/setup-go@v5 + - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: go-version: ">=1.24.0" cache: true cache-dependency-path: go.sum - - uses: oven-sh/setup-bun@v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 with: bun-version: 1.2.19 - name: Cache ~/.bun id: cache-bun - uses: actions/cache@v3 + uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3 with: path: ~/.bun key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }} diff --git a/.github/workflows/stats.yml b/.github/workflows/stats.yml index ab7f24e27863..45a90e7af171 100644 --- a/.github/workflows/stats.yml +++ b/.github/workflows/stats.yml @@ -13,10 +13,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Setup Bun - uses: oven-sh/setup-bun@v2 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 with: bun-version: latest diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml index 01aa398b55d4..182c976ade88 100644 --- a/.github/workflows/typecheck.yml +++ b/.github/workflows/typecheck.yml @@ -5,15 +5,18 @@ on: branches: [dev] workflow_dispatch: +permissions: + contents: read + jobs: typecheck: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Setup Bun - uses: oven-sh/setup-bun@v1 + uses: oven-sh/setup-bun@f4d14e03ff726c06358e5557344e1da148b56cf7 # v1 with: bun-version: 1.2.19