Pin the CI and publish actions to SHAs and scope their tokens - #16
Merged
Conversation
anna-agafonova
marked this pull request as ready for review
August 27, 2026 07:07
zizmor reported ten findings on this repository, all of them in ci.yml and
publish.yml - security.yaml was already clean:
6x high unpinned-uses actions/checkout@v6, erlef/setup-beam@v1,
actions/cache@v5, in both workflows
2x high excessive-permissions neither workflow declares `permissions:`,
so both run on the default broad token
2x low artipacked checkout leaves its credential on disk
WHAT THE SHAs ARE
Each ref is pinned to the commit its floating tag pointed at when this was
written, so the same code runs before and after - this freezes behaviour, it
does not upgrade anything:
d23441a48e516b6c34aea4fa41551a30e30af803 actions/checkout v6.1.0
54075bcc5e249e4758d363f27d099f55d843f124 erlef/setup-beam v1.24.1
caa296126883cff596d87d8935842f9db880ef25 actions/cache v5.1.0
Recorded here rather than as `# vX.Y.Z` trailers, so the workflows stay
comment-free and match security.yaml, which pins bare SHAs already. A tag can
be moved under you; a SHA cannot, and that is the whole point of the change.
Separately worth knowing, and deliberately NOT bundled here: checkout and
cache are each a major version behind (v7 and v6 are out). Upgrading them is
a behaviour change and belongs in its own PR.
WHY THESE PERMISSIONS
Both workflows get `permissions: contents: read`, which is everything either
one needs:
ci.yml only reads the repo and runs the suite. It publishes nothing
and writes nothing back.
publish.yml ships to hex.pm authenticated by HEX_API_KEY, never back to
this repository, so the GitHub token only reads the checkout.
`persist-credentials: false` on both checkouts for the same reason - nothing
downstream pushes, so the credential does not need to outlive the step or end
up inside an uploaded artifact.
WHAT IS NOT TOUCHED
security.yaml stays. It is the Elixir Snyk scan, and per the Snyk
repository-setup guide the Elixir workflow is the one supported path - the
GitHub Cloud App does not cover hex. Only the Go, npm, pip and rubygems scan
workflows are deprecated, and this repository has none of them.
zizmor is clean after this change, and both CI matrix legs pass.
anna-agafonova
force-pushed
the
devx.pin-actions-scope-tokens
branch
from
August 27, 2026 07:13
18381e9 to
c441293
Compare
kdrabek-glia
approved these changes
Aug 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
zizmor reported ten findings on this repository, all of them in ci.yml and
publish.yml - security.yaml was already clean:
6x high unpinned-uses actions/checkout@v6, erlef/setup-beam@v1,
actions/cache@v5, in both workflows
2x high excessive-permissions neither workflow declares
permissions:,so both run on the default broad token
2x low artipacked checkout leaves its credential on disk
WHAT THE SHAs ARE
Each ref is pinned to the commit its floating tag pointed at when this was
written, so the same code runs before and after - this freezes behaviour, it
does not upgrade anything:
d23441a48e516b6c34aea4fa41551a30e30af803 actions/checkout v6.1.0
54075bcc5e249e4758d363f27d099f55d843f124 erlef/setup-beam v1.24.1
caa296126883cff596d87d8935842f9db880ef25 actions/cache v5.1.0
Recorded here rather than as
# vX.Y.Ztrailers, so the workflows staycomment-free and match security.yaml, which pins bare SHAs already. A tag can
be moved under you; a SHA cannot, and that is the whole point of the change.
Separately worth knowing, and deliberately NOT bundled here: checkout and
cache are each a major version behind (v7 and v6 are out). Upgrading them is
a behaviour change and belongs in its own PR.
WHY THESE PERMISSIONS
Both workflows get
permissions: contents: read, which is everything eitherone needs:
ci.yml only reads the repo and runs the suite. It publishes nothing
and writes nothing back.
publish.yml ships to hex.pm authenticated by HEX_API_KEY, never back to
this repository, so the GitHub token only reads the checkout.
persist-credentials: falseon both checkouts for the same reason - nothingdownstream pushes, so the credential does not need to outlive the step or end
up inside an uploaded artifact.
WHAT IS NOT TOUCHED
security.yaml stays. It is the Elixir Snyk scan, and per the Snyk
repository-setup guide the Elixir workflow is the one supported path - the
GitHub Cloud App does not cover hex. Only the Go, npm, pip and rubygems scan
workflows are deprecated, and this repository has none of them.
zizmor is clean after this change, and both CI matrix legs pass.