Repository navigation
security: pin GitHub Actions to SHAs, scope workflow permissions, enable Dependabot - #4
Merged
Merged
Conversation
- Pin every third-party Action to a full 40-char commit SHA with a # vX.Y.Z comment, defeating tag-mutation supply-chain attacks. Mirrors StreamnDad/reeln-cli#29. - Add explicit job-level `permissions: contents: read` so GITHUB_TOKEN is least-privileged. Jobs that need write scopes keep them alongside. - Add .github/dependabot.yml so Dependabot opens weekly grouped dependency PRs going forward, and is positioned to file security updates the moment they're published. Co-Authored-By: Claude <noreply@anthropic.com>
`cargo update` within existing semver constraints. Picks up patch/minor releases that close known advisories without touching Cargo.toml. Co-Authored-By: Claude <noreply@anthropic.com>
JRemitz
force-pushed
the
security/pin-actions-and-scope-permissions
branch
from
June 9, 2026 12:54
10a278a to
ad87221
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Propagates the security hardening from StreamnDad/reeln-cli#29 to this repo.
# vX.Y.Zcomment. Defeats tag-mutation supply-chain attacks (highest-risk action being any that runs withid-token: write).permissions: contents: readsoGITHUB_TOKENis scoped to the minimum needed. Jobs that need write scopes keep them alongside..github/dependabot.ymlso Dependabot opens weekly grouped dependency PRs across every ecosystem this repo uses. Pairs with enabling Dependabot security updates at the repo level (done out-of-band via API).Test plan
actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5is v4.3.1)🤖 Generated with Claude Code