From 9f86f1ed2fed7a2f2bdeef4897f04eff5072256a Mon Sep 17 00:00:00 2001 From: Eden Zimbelman Date: Thu, 27 Aug 2026 00:54:43 -0700 Subject: [PATCH 1/2] =?UTF-8?q?ci:=20harden=20workflows=20=E2=80=94=20pin?= =?UTF-8?q?=20actions=20to=20SHAs,=20scope=20permissions?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Address zizmor findings in the Test workflow: - Pin actions to full-length commit SHAs (2x High unpinned-uses) - Add least-privilege top-level permissions: contents: read (Medium) - Set persist-credentials: false on checkout (Low artipacked) Co-Authored-By: Claude --- .github/workflows/test.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index a9652c3..22c9924 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -4,6 +4,8 @@ on: branches: - main pull_request: +permissions: + contents: read jobs: test: name: "maven@java17" @@ -15,9 +17,11 @@ jobs: - "methods" steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Install JDK - uses: actions/setup-java@v6 + uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: java-version: 17 distribution: "temurin" From 21f1800f5cc8933078c7ad833dd26c6fc8b74089 Mon Sep 17 00:00:00 2001 From: Eden Zimbelman Date: Thu, 27 Aug 2026 00:57:28 -0700 Subject: [PATCH 2/2] ci: scope permissions to the job rather than workflow top level Co-Authored-By: Claude --- .github/workflows/test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 22c9924..8c900e7 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -4,12 +4,12 @@ on: branches: - main pull_request: -permissions: - contents: read jobs: test: name: "maven@java17" runs-on: ubuntu-latest + permissions: + contents: read strategy: matrix: showcase: