Skip to content

CI: Harden GHA configuration #308

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 5 commits into from
Jul 20, 2025
Merged

CI: Harden GHA configuration #308

merged 5 commits into from
Jul 20, 2025

Conversation

tacaswell
Copy link
Member

Apply recommended hardening steps including:

  • pinning to a SHA any actions used
  • not persisting the read token on checkout
  • setting the default permissions
  • adding a depandabot file for GHA

tacaswell added 5 commits July 17, 2025 21:02
@tacaswell
CI: pin actions by SHA
9c959e9 
This eliminates the possibility of a tag being changed under
us.
@tacaswell
CI: pin actions by SHA
f1b0255 
This eliminates the possibility of a tag being changed under
us.
@tacaswell
CI: auto-fix via zizmor
3e690b4 
May include:

- Avoids risky string interpolation.
- Prevents checkout premissions from leaking
@tacaswell
CI: Restrict default permissions
df58a93 
Reduces risk of arbitrary code is run by attacker.
@tacaswell
CI: run pre-commit on GHA
90e38c3
@tacaswell
Copy link
Member Author

See matplotlib/matplotlib#30045 but precommit.ci has been disabled at the org level, not sure what else needs to be done to get rid of the check.

@samcunliffe
Copy link
Collaborator

precommit.ci has been disabled at the org level, not sure what else needs to be done to get rid of the check

Looks like that worked! pre-commit.ci is one of our required checks, and it hasn't run. So @dstansby (or anyone else with access to repo settings) we just need to switch to requiring the GHA "precommit" added here.

Screenshot 2025-07-19 at 11 11 07

👍 Dependabot will send update PRs updating the SHAs.

@samcunliffe samcunliffe added Maintenance Not related to the development of new features dependencies Pull requests that update a dependency file github actions Pull requests that update GitHub Actions code labels Jul 19, 2025
@dstansby
Copy link
Member

Thanks for this - I have removed pre-commit.ci as a required build, but for this PR will just bypass the rules and merge instead of trying to remvoe pre-commit.ci as a required check.

@dstansby dstansby merged commit 64edb23 into matplotlib:main Jul 20, 2025
13 checks passed
@tacaswell tacaswell deleted the harden_gha branch July 21, 2025 15:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@samcunliffe samcunliffe samcunliffe approved these changes

Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file github actions Pull requests that update GitHub Actions code Maintenance Not related to the development of new features
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@tacaswell @samcunliffe @dstansby