From a86fe08d9b3cb9bea5a953845c0256cb4ad489eb Mon Sep 17 00:00:00 2001 From: Travis Leeden Date: Fri, 16 Oct 2026 15:50:57 +1000 Subject: [PATCH] Harden Github workflows --- .github/workflows/build-and-test.yml | 3 ++- .github/workflows/dist.yml | 3 +++ .github/workflows/integration-test.yml | 3 ++- .github/workflows/pr-title-validation.yml | 6 ++++++ .github/workflows/release-please.yml | 3 +++ 5 files changed, 16 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml index 7cd059ad1..8aed3dc4c 100644 --- a/.github/workflows/build-and-test.yml +++ b/.github/workflows/build-and-test.yml @@ -12,6 +12,7 @@ jobs: permissions: # https://github.com/dorny/test-reporter/issues/168 statuses: write checks: write + contents: read steps: - uses: actions/checkout@v7 @@ -31,7 +32,7 @@ jobs: run: go build -o bin/octopus cmd/octopus/main.go - name: Setup gotestsum - run: go install gotest.tools/gotestsum@latest + run: go install gotest.tools/gotestsum@v1.13.0 - name: Unit Tests run: gotestsum --format testname --junitfile ../unit-tests.xml diff --git a/.github/workflows/dist.yml b/.github/workflows/dist.yml index f8a334c46..f0dc94a0f 100644 --- a/.github/workflows/dist.yml +++ b/.github/workflows/dist.yml @@ -3,6 +3,9 @@ on: branches: - release-please--** name: "Update Install Script Version" +# Checkout persists INTEGRATIONS_MD_BOT_TOKEN, which is what the push uses; the default GITHUB_TOKEN only needs read +permissions: + contents: read jobs: build: runs-on: ubuntu-latest diff --git a/.github/workflows/integration-test.yml b/.github/workflows/integration-test.yml index 2ffba5bd7..bf191a1fa 100644 --- a/.github/workflows/integration-test.yml +++ b/.github/workflows/integration-test.yml @@ -51,6 +51,7 @@ jobs: permissions: # https://github.com/dorny/test-reporter/issues/168 statuses: write checks: write + contents: read steps: - uses: actions/checkout@v7 @@ -60,7 +61,7 @@ jobs: go-version-file: go.mod - name: Setup gotestsum - run: go install gotest.tools/gotestsum@latest + run: go install gotest.tools/gotestsum@v1.13.0 - name: Integration Tests env: diff --git a/.github/workflows/pr-title-validation.yml b/.github/workflows/pr-title-validation.yml index cf7aa7f87..fce8f6aa3 100644 --- a/.github/workflows/pr-title-validation.yml +++ b/.github/workflows/pr-title-validation.yml @@ -5,9 +5,15 @@ on: pull_request: types: [opened, reopened, edited] +permissions: + contents: read + jobs: validate-pr-title: runs-on: ubuntu-latest + permissions: + # The action labels the PR with its conventional commit type + pull-requests: write steps: - name: PR Conventional Commit Validation uses: ytanikin/PRConventionalCommits@b628c5a234cc32513014b7bfdd1e47b532124d98 # 1.3.0 diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 841634888..fa246cb08 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -3,6 +3,9 @@ on: branches: - main name: release-please +# release-please authenticates with INTEGRATIONS_MD_BOT_TOKEN, so the default GITHUB_TOKEN needs nothing beyond read +permissions: + contents: read jobs: release-please-release: runs-on: ubuntu-latest