From 8cb5d8a5fd1cc636dafe1f4f19c8eff3ff70b005 Mon Sep 17 00:00:00 2001 From: Alb3e3 <74142887+Alb3e3@users.noreply.github.com> Date: Fri, 12 Jun 2026 00:28:52 +0200 Subject: [PATCH] ci: add read-only token permissions and pin actions/checkout to SHA Both CI workflows (autotools and cmake) lacked a top-level permissions block, leaving them to inherit the repository default (potentially write-all). Each now has `permissions: read-all` at the top level. The actions/checkout@v2 reference in both workflows was also pinned to the full commit SHA of the current v6.0.3 release, replacing the mutable version tag with an immutable reference that is immune to tag rewriting. Verified with zizmor --min-severity medium: no findings after this patch. Signed-off-by: Alb3e3 --- .github/workflows/autotools.yml | 4 +++- .github/workflows/cmake.yml | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/autotools.yml b/.github/workflows/autotools.yml index 0ae340ee..1196ba31 100644 --- a/.github/workflows/autotools.yml +++ b/.github/workflows/autotools.yml @@ -6,6 +6,8 @@ on: schedule: - cron: '0 0 1 * *' +permissions: read-all + jobs: build: strategy: @@ -19,7 +21,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Install macOS dependencies if: startsWith(matrix.os,'macos') diff --git a/.github/workflows/cmake.yml b/.github/workflows/cmake.yml index dfb78b23..11bb7647 100644 --- a/.github/workflows/cmake.yml +++ b/.github/workflows/cmake.yml @@ -6,6 +6,8 @@ on: schedule: - cron: '0 0 1 * *' +permissions: read-all + jobs: build: strategy: @@ -23,7 +25,7 @@ jobs: BUILD: _build steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Prepare build directory run: mkdir ${{ env.BUILD }}