Repository navigation
Harden workflow permissions and credentials - #2648
Open
somewhatabstract wants to merge 5 commits into
Open
somewhatabstract wants to merge 5 commits into
somewhatabstract wants to merge 5 commits into
Conversation
Tags can be moved to point at different code, so a compromised action repository could run malicious code in every workflow that references it by tag, including the release workflow, which holds publishing credentials. A full commit SHA can't be moved. Each SHA was resolved from the tag it replaces and checked again against the tag in its version comment. changesets/action@v1 was a branch, not a tag; it's pinned to v1.9.0, which is the branch's current commit. Dependabot's github-actions updates keep the pins and comments current. Closes #2643. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QjLhVH1NnUc7MzCSYLd8Yn
- Give the default GITHUB_TOKEN read-only access in Node CI and Rust CI, which set no permissions and so got the repository default. The lint job also gets pull-requests: read for the changesets check. - Stop actions/checkout leaving the token in .git/config, where any later step could read it. No job pushes with git. - Replace the release workflow's `npm install -g npm@latest` with a check. Every Node.js 24 release since 24.5.0 bundles npm 11.5.1 or later, so the upgrade never ran; if it ever did, it would install an unpinned npm in the job that publishes to npm. Found by zizmor (excessive-permissions, artipacked, adhoc-packages). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QjLhVH1NnUc7MzCSYLd8Yn
…72zesp-harden-workflows # Conflicts: # .github/workflows/codeql-analysis.yml # .github/workflows/nodejs.yml # .github/workflows/rust.yml
🦋 Changeset detectedLatest commit: f896d9c The changes in this PR will be included in the next version bump. This PR includes changesets to release 0 packagesWhen changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
This was referenced Oct 30, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2648 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 51 51
Lines 959 959
Branches 232 231 -1
=========================================
Hits 959 959 Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
Bundle ReportBundle size has no change ✅ |
Dependabot rejects semver-major-days for the github-actions ecosystem, which made the whole dependabot.yml invalid and stopped version updates. The JSON schema the config was checked against didn't know about that restriction. GitHub Actions keeps the 7-day default cooldown. Fixes the config added in #2645. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QjLhVH1NnUc7MzCSYLd8Yn
…/jolly-galileo-72zesp-harden-workflows
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the workflow findings zizmor reported, apart from those in the Dependabot workflow, which #2646 handles:
permissions:, so their token got the repository's default access. They're now read-only.actions/checkout: it no longer leaves the token in.git/config, where any later step could read it.npm@latest.Stack
main, which includes Pin GitHub Actions to commit SHAs #2644 (SHA pins) and Delay Dependabot version updates with a cooldown #2645 (Dependabot cooldown).pull_request), then Audit workflows with zizmor #2647 (zizmor workflow).Issues
Part of #2642's supply-chain hardening, alongside #2643.
Details
excessive-permissions:nodejs.ymlandrust.ymlnow have a top-levelpermissions: contents: read.pull-requests: read, because the changesets check (Khan/actions→get-changed-files) looks up the pull request for a commit through the API.codeql-analysis.ymlandrelease.ymlalready set their own permissions.artipacked:persist-credentials: falseis set on everyactions/checkoutthat lacked it: 4 innodejs.yml, 2 inrust.ymland 1 incodeql-analysis.yml. None of these jobs pushes with git. The changesets check reads the changed files from the API, not git (I checked its source at the pinned commit), andrelease.ymlalready sets it.adhoc-packages:release.ymlrannpm install -g npm@latestwhenever npm was older than 11.5.1, the minimum for trusted publishing.setup-nodewith24.xcurrently installs 24.22.2, which bundles npm 11.19.1. So the upgrade never ran.Review notes
persist-credentials: falseto it when I next bringmaininto the checksum stack. Audit workflows with zizmor #2647 would catch it otherwise.Generated by Claude Code