amadan
ci: pin softprops/action-gh-release by commit + drop persisted git credentials (#942)
Aikido triage follow-ups. softprops/action-gh-release was referenced by the mutable v1 tag inside a job holding contents:write — pinned to the tag's current commit (de2c0eb). The three checkouts that never push get persist-credentials: false; the website checkout in the guide sync keeps its credential (its push depends on it).
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
3 files changed,
+13
−1
.github/workflows/build-apps.yml+7 −1.github/workflows/sync-guide-to-website.yml+3 −0.github/workflows/test.yml+3 −0
diff --git a/.github/workflows/build-apps.yml b/.github/workflows/build-apps.yml| index 529d995..9d499c4 100644 |
| --- a/.github/workflows/build-apps.yml |
| +++ b/.github/workflows/build-apps.yml |
| @@ -28,6 +28,10 @@ jobs: |
| steps: |
| - name: Checkout code |
| uses: actions/checkout@v4 |
| + with: |
| + # Nothing here pushes back to the repo — the release step uses the |
| + # GITHUB_TOKEN via the API, not the persisted git credential. |
| + persist-credentials: false |
| - name: Install xcodegen |
| run: brew install xcodegen |
| @@ -63,7 +67,9 @@ jobs: |
| - name: Create release |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' |
| - uses: softprops/action-gh-release@v1 |
| + # Third-party action, so pinned by commit (a mutable tag could be |
| + # repointed at hostile code that sees this job's contents: write). |
| + uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1 |
| with: |
| files: ios/build/Build/Products/Debug/Eleven.app.zip |
| tag_name: app-build-${{ github.run_number }} |
diff --git a/.github/workflows/sync-guide-to-website.yml b/.github/workflows/sync-guide-to-website.yml| index 2069205..49b5287 100644 |
| --- a/.github/workflows/sync-guide-to-website.yml |
| +++ b/.github/workflows/sync-guide-to-website.yml |
| @@ -28,6 +28,9 @@ jobs: |
| with: |
| sparse-checkout: docs/planet-scale-guide |
| sparse-checkout-cone-mode: true |
| + # Read-only source checkout; the push below uses the website |
| + # checkout's own WEBSITE_REPO_TOKEN, not this credential. |
| + persist-credentials: false |
| - name: Check for the website repo token |
| id: check-token |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml| index 7aac3d2..3982522 100644 |
| --- a/.github/workflows/test.yml |
| +++ b/.github/workflows/test.yml |
| @@ -22,6 +22,9 @@ jobs: |
| steps: |
| - uses: actions/checkout@v4 |
| + with: |
| + # Test-only job — nothing needs the persisted git credential. |
| + persist-credentials: false |
| - name: Set up Go |
| uses: actions/setup-go@v5 |