From 2927b91e50d95d23db093ece6d40fe8073dda2d0 Mon Sep 17 00:00:00 2001 From: Matt Hammond Date: Wed, 27 May 2026 13:57:27 +0100 Subject: [PATCH 1/5] ci: disable credential persistence on checkout Add persist-credentials: false to actions/checkout steps so the default GITHUB_TOKEN is not left in the local git config after checkout. Steps later in the job do not push to the repo. --- .github/workflows/check.yml | 1 + .github/workflows/release.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 28d5f2f..0fd3aae 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -19,6 +19,7 @@ jobs: - uses: actions/checkout@v4 with: submodules: true + persist-credentials: false - name: Set up Python ${{ matrix.python-version }} uses: actions/setup-python@v5 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3b88120..341d517 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,6 +15,7 @@ jobs: - uses: actions/checkout@v4 with: submodules: true + persist-credentials: false - name: Set up Python 3.12 uses: actions/setup-python@v5 From 3c0e53677cb91120561b9ea8facbd8a3fe7ba717 Mon Sep 17 00:00:00 2001 From: Matt Hammond Date: Wed, 27 May 2026 13:57:44 +0100 Subject: [PATCH 2/5] ci: scope job permissions explicitly Add top-level permissions: {} to both workflows and grant each job only the GITHUB_TOKEN scopes it actually needs. The check job and the build job in release only need contents: read; the publish jobs already declare id-token: write for trusted publishing. --- .github/workflows/check.yml | 4 ++++ .github/workflows/release.yml | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 0fd3aae..1717afc 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -7,9 +7,13 @@ on: branches: - main +permissions: {} + jobs: check: runs-on: ubuntu-latest + permissions: + contents: read strategy: fail-fast: false matrix: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 341d517..574f2b7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -6,10 +6,14 @@ on: tags: - 'v[0-9]+.[0-9]+.[0-9]+*' +permissions: {} + jobs: build: name: Build distribution 📦 runs-on: ubuntu-latest + permissions: + contents: read steps: - uses: actions/checkout@v4 From cf4f130db02ddbf658aff795933083043c122521 Mon Sep 17 00:00:00 2001 From: Matt Hammond Date: Wed, 27 May 2026 13:58:01 +0100 Subject: [PATCH 3/5] ci: move workflow context out of run shell source Bind ${{ steps.setup-python.outputs.python-path }} to an env variable and reference it as "$PYTHON_PATH" in the shell script, so the value is never interpolated into the script source. --- .github/workflows/check.yml | 4 +++- .github/workflows/release.yml | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 1717afc..632b34d 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -37,8 +37,10 @@ jobs: poetry-version: '2.1.4' - name: Setup a local virtual environment + env: + PYTHON_PATH: ${{ steps.setup-python.outputs.python-path }} run: | - poetry env use ${{ steps.setup-python.outputs.python-path }} + poetry env use "$PYTHON_PATH" poetry run python --version poetry config virtualenvs.create true --local poetry config virtualenvs.in-project true --local diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 574f2b7..1a0fb4d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -33,8 +33,10 @@ jobs: poetry-version: '2.1.4' - name: Setup a local virtual environment + env: + PYTHON_PATH: ${{ steps.setup-python.outputs.python-path }} run: | - poetry env use ${{ steps.setup-python.outputs.python-path }} + poetry env use "$PYTHON_PATH" poetry run python --version poetry config virtualenvs.create true --local poetry config virtualenvs.in-project true --local From c4eafefb81af35a4d9e9770fcc489564ab2e79d2 Mon Sep 17 00:00:00 2001 From: Matt Hammond Date: Wed, 27 May 2026 13:58:49 +0100 Subject: [PATCH 4/5] ci: pin third-party actions to commit SHAs Pin every external action reference to a full 40-char commit SHA, with the previous tag preserved as a trailing comment. This prevents an upstream tag move from silently changing what runs in CI. --- .github/workflows/check.yml | 8 ++++---- .github/workflows/release.yml | 18 +++++++++--------- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 632b34d..130d400 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -20,19 +20,19 @@ jobs: python-version: ['3.9', '3.10', '3.11', '3.12'] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: submodules: true persist-credentials: false - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 id: setup-python with: python-version: ${{ matrix.python-version }} - name: Setup poetry - uses: abatilo/actions-poetry@v4 + uses: abatilo/actions-poetry@0dd19c9498c3dc8728967849d0d2eae428a8a3d8 # v4 with: poetry-version: '2.1.4' @@ -45,7 +45,7 @@ jobs: poetry config virtualenvs.create true --local poetry config virtualenvs.in-project true --local - - uses: actions/cache@v4 + - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 name: Define a cache for the virtual environment based on the dependencies lock file id: cache with: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1a0fb4d..a0f080c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -16,19 +16,19 @@ jobs: contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: submodules: true persist-credentials: false - name: Set up Python 3.12 - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 id: setup-python with: python-version: 3.12 - name: Setup poetry - uses: abatilo/actions-poetry@v4 + uses: abatilo/actions-poetry@0dd19c9498c3dc8728967849d0d2eae428a8a3d8 # v4 with: poetry-version: '2.1.4' @@ -41,7 +41,7 @@ jobs: poetry config virtualenvs.create true --local poetry config virtualenvs.in-project true --local - - uses: actions/cache@v4 + - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 name: Define a cache for the virtual environment based on the dependencies lock file id: cache with: @@ -58,7 +58,7 @@ jobs: - name: Build a binary wheel and a source tarball run: poetry build - name: Store the distribution packages - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: python-package-distributions path: dist/ @@ -77,7 +77,7 @@ jobs: steps: - name: Download all the dists - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: python-package-distributions path: dist/ @@ -104,7 +104,7 @@ jobs: VERSION: ${{ steps.version.outputs.version }} TAG: ${{ steps.tag.outputs.tag }} - name: Publish distribution 📦 to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0 publish-to-testpypi: name: Publish Python distribution to TestPyPI @@ -121,11 +121,11 @@ jobs: steps: - name: Download all the dists - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: python-package-distributions path: dist/ - name: Publish distribution 📦 to TestPyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0 with: repository-url: https://test.pypi.org/legacy/ \ No newline at end of file From 7e976fa46df938b005dede9a1ad9c398c3da8013 Mon Sep 17 00:00:00 2001 From: Matt Hammond Date: Wed, 27 May 2026 13:59:14 +0100 Subject: [PATCH 5/5] ci: drop venv cache from release workflow Remove the actions/cache step (and its companion 'Ensure cache is healthy' step) from the release build. Caches restored into the build that produces published artifacts are a poisoning vector, and the cache key referenced ${{ matrix.python-version }} from a non-matrix job so it was resolving to an empty segment anyway. The check workflow still caches the venv across PR/push runs. --- .github/workflows/release.yml | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a0f080c..819c344 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -41,18 +41,6 @@ jobs: poetry config virtualenvs.create true --local poetry config virtualenvs.in-project true --local - - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 - name: Define a cache for the virtual environment based on the dependencies lock file - id: cache - with: - path: ./.venv - key: venv-${{ runner.os }}-${{ matrix.python-version }}-${{ hashFiles('poetry.lock') }} - - - name: Ensure cache is healthy - if: steps.cache.outputs.cache-hit == 'true' - shell: bash - run: poetry run pip --version >/dev/null 2>&1 || (echo "Cache is broken, skip it" && rm -rf .venv) - - name: Install dependencies run: poetry install - name: Build a binary wheel and a source tarball