From 05657922a019d9693a1751d4ac87f855ebe5ed22 Mon Sep 17 00:00:00 2001 From: Matt Hammond Date: Tue, 26 May 2026 12:44:36 +0100 Subject: [PATCH 1/3] ci: disable credential persistence on checkout MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Set `persist-credentials: false` on all `actions/checkout` steps so the default `GITHUB_TOKEN` is not written to the local git config after checkout. Addresses a finding from a routine workflow audit. No behavioural change — these workflows do not push back to the repo using the auto-persisted credentials. --- .github/workflows/check.yml | 4 ++++ .github/workflows/publish-json-schemas.yml | 2 ++ .github/workflows/publish.yml | 2 ++ .github/workflows/sync-to-s3.yml | 2 ++ 4 files changed, 10 insertions(+) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index d02135fd..a76922a3 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -9,6 +9,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 + with: + persist-credentials: false - name: Read Tool Versions id: tool-versions @@ -31,6 +33,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 + with: + persist-credentials: false - name: Read Tool Versions id: tool-versions diff --git a/.github/workflows/publish-json-schemas.yml b/.github/workflows/publish-json-schemas.yml index 4da04658..d10d5147 100644 --- a/.github/workflows/publish-json-schemas.yml +++ b/.github/workflows/publish-json-schemas.yml @@ -10,6 +10,8 @@ jobs: id-token: write steps: - uses: actions/checkout@v2 + with: + persist-credentials: false - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v1 diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 846bf517..8c7e6a9a 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -8,6 +8,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 + with: + persist-credentials: false - name: Read Tool Versions id: tool-versions diff --git a/.github/workflows/sync-to-s3.yml b/.github/workflows/sync-to-s3.yml index cfba3ec2..03274f67 100644 --- a/.github/workflows/sync-to-s3.yml +++ b/.github/workflows/sync-to-s3.yml @@ -25,6 +25,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@v4 + with: + persist-credentials: false - name: Setup Node.js uses: actions/setup-node@v4 From 70c796c66564b1bf0bc53091449bacd2c099cef5 Mon Sep 17 00:00:00 2001 From: Matt Hammond Date: Tue, 26 May 2026 12:45:40 +0100 Subject: [PATCH 2/3] ci: scope workflow and job permissions explicitly MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add top-level `permissions: {}` to each workflow and grant each job only the `GITHUB_TOKEN` scopes it actually uses (`contents: read`, plus `id-token: write` where OIDC is needed to assume an AWS role). Addresses a finding from a routine workflow audit. No behavioural change — the same operations succeed with the narrower scopes. --- .github/workflows/check.yml | 6 ++++++ .github/workflows/publish-json-schemas.yml | 5 ++++- .github/workflows/publish.yml | 4 ++++ .github/workflows/sync-to-s3.yml | 8 ++++---- 4 files changed, 18 insertions(+), 5 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index a76922a3..fbebb54f 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -4,9 +4,13 @@ on: branches: - main +permissions: {} + jobs: check: runs-on: ubuntu-latest + permissions: + contents: read steps: - uses: actions/checkout@v2 with: @@ -31,6 +35,8 @@ jobs: check-go: runs-on: ubuntu-latest + permissions: + contents: read steps: - uses: actions/checkout@v2 with: diff --git a/.github/workflows/publish-json-schemas.yml b/.github/workflows/publish-json-schemas.yml index d10d5147..922e3e41 100644 --- a/.github/workflows/publish-json-schemas.yml +++ b/.github/workflows/publish-json-schemas.yml @@ -3,11 +3,14 @@ on: workflow_dispatch +permissions: {} + jobs: publish: runs-on: ubuntu-latest permissions: - id-token: write + contents: read + id-token: write # Required for OIDC assume-role into AWS steps: - uses: actions/checkout@v2 with: diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 8c7e6a9a..974b61ba 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -3,9 +3,13 @@ on: workflow_dispatch +permissions: {} + jobs: publish-go: runs-on: ubuntu-latest + permissions: + contents: read steps: - uses: actions/checkout@v2 with: diff --git a/.github/workflows/sync-to-s3.yml b/.github/workflows/sync-to-s3.yml index 03274f67..5b8c8bf8 100644 --- a/.github/workflows/sync-to-s3.yml +++ b/.github/workflows/sync-to-s3.yml @@ -14,14 +14,14 @@ on: - cron: "0 2 * * *" workflow_dispatch: # Allow manual trigger -permissions: - id-token: write # Required for OIDC - contents: read +permissions: {} jobs: generate-and-sync: runs-on: ubuntu-latest - + permissions: + contents: read + id-token: write # Required for OIDC assume-role into AWS steps: - name: Checkout repository uses: actions/checkout@v4 From 7c8708b4bf685e505da2cde09d85c7b2e604b6f6 Mon Sep 17 00:00:00 2001 From: Matt Hammond Date: Tue, 26 May 2026 12:46:51 +0100 Subject: [PATCH 3/3] ci: pin third-party actions to commit SHAs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Pin every `uses:` reference to a commit SHA, preserving the existing major-version tag as a trailing comment. This stops an upstream tag move from silently changing what runs in CI. Addresses a finding from a routine workflow audit. No version bumps — each pinned SHA is the current head of the same major version tag the workflow already used. --- .github/workflows/check.yml | 8 ++++---- .github/workflows/publish-json-schemas.yml | 6 +++--- .github/workflows/publish.yml | 4 ++-- .github/workflows/sync-to-s3.yml | 6 +++--- 4 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index fbebb54f..9528d998 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -12,7 +12,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 with: persist-credentials: false @@ -20,7 +20,7 @@ jobs: id: tool-versions run: echo "::set-output name=nodejs::$(sed -nr 's/nodejs ([0-9]+)/\1/p' .tool-versions)" - - uses: actions/setup-node@v2 + - uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2 with: node-version: ${{ steps.tool-versions.outputs.nodejs }} @@ -38,7 +38,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 with: persist-credentials: false @@ -47,7 +47,7 @@ jobs: run: echo "::set-output name=golang::$(sed -nr 's/golang ([0-9]+)/\1/p' .tool-versions)" - name: Setup Go - uses: actions/setup-go@v2 + uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 # v2 with: go-version: ${{ steps.tool-versions.outputs.golang }} diff --git a/.github/workflows/publish-json-schemas.yml b/.github/workflows/publish-json-schemas.yml index 922e3e41..110d19cf 100644 --- a/.github/workflows/publish-json-schemas.yml +++ b/.github/workflows/publish-json-schemas.yml @@ -12,12 +12,12 @@ jobs: contents: read id-token: write # Required for OIDC assume-role into AWS steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 with: persist-credentials: false - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v1 + uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838 # v1 with: aws-region: eu-west-2 role-to-assume: arn:aws:iam::${{ secrets.ABLY_AWS_ACCOUNT_ID_SDK}}:role/ably-sdk-schemas-ably-common @@ -27,7 +27,7 @@ jobs: id: tool-versions run: echo "::set-output name=nodejs::$(sed -nr 's/nodejs ([0-9]+)/\1/p' .tool-versions)" - - uses: actions/setup-node@v2 + - uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2 with: node-version: ${{ steps.tool-versions.outputs.nodejs }} diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 974b61ba..02f8ad2c 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -11,7 +11,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 with: persist-credentials: false @@ -20,7 +20,7 @@ jobs: run: echo "::set-output name=golang::$(sed -nr 's/golang ([0-9]+)/\1/p' .tool-versions)" - name: Setup Go - uses: actions/setup-go@v2 + uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 # v2 with: go-version: ${{ steps.tool-versions.outputs.golang }} diff --git a/.github/workflows/sync-to-s3.yml b/.github/workflows/sync-to-s3.yml index 5b8c8bf8..888148b5 100644 --- a/.github/workflows/sync-to-s3.yml +++ b/.github/workflows/sync-to-s3.yml @@ -24,12 +24,12 @@ jobs: id-token: write # Required for OIDC assume-role into AWS steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: "18" cache: "npm" @@ -55,7 +55,7 @@ jobs: npm run fetch:agent-releases - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v1 + uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838 # v1 with: aws-region: eu-west-2 role-to-assume: arn:aws:iam::${{ secrets.ABLY_AWS_ACCOUNT_ID_SDK}}:role/ably-sdk-schemas-ably-common