Skip to content

CI: Harden GHA configuration#117

Open
tacaswell wants to merge 4 commits intomatplotlib:mainfrom
tacaswell:harden_gha
Open

CI: Harden GHA configuration#117
tacaswell wants to merge 4 commits intomatplotlib:mainfrom
tacaswell:harden_gha

Conversation

@tacaswell
Copy link
Member

Apply recommended hardening steps including:

  • pinning to a SHA any actions used
  • not persisting the read token on checkout
  • setting the default permissions
  • adding a depandabot file for GHA

This eliminates the possibility of a tag being changed under
us.
This eliminates the possibility of a tag being changed under
us.
May include:

- Avoids risky string interpolation.
- Prevents checkout premissions from leaking
Reduces risk of arbitrary code is run by attacker.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant