From 6202084ec73847e0c2ab1e4c8cb999e0e266953f Mon Sep 17 00:00:00 2001 From: Thibaud-Vdb Date: Tue, 4 Aug 2026 17:01:56 +0200 Subject: [PATCH 1/3] CI: pins actions to commit SHAs A version tag like @v1 or a branch like @master is a movable pointer: whoever controls the action repository can re-point it, and the next run executes whatever it points at. Several of these actions run in jobs whose outputs ship to users: build-release.yml creates the GitHub release with the downloadable binaries, and build-windows-hosts.yml holds the SignPath signing token, so a re-pointed tag there could ship a tampered or wrongly signed release. This is exactly how the tj-actions/changed-files compromise propagated (CVE-2025-30066). Pinning by full commit SHA makes the reviewed code the code that runs, the same way docker/setup-qemu-action is already pinned in build-linux-vms.yml. Refs that pointed at master (cross-platform-actions, setup-alpine, get-latest-release) are pinned to their latest release tag. Every pin keeps a version comment, and each SHA was resolved from the upstream repository and cross-checked against its release tag. --- .github/workflows/build-dragonfly-amd64.yml | 6 +++--- .github/workflows/build-freebsd-amd64.yml | 6 +++--- .github/workflows/build-haiku-amd64.yml | 6 +++--- .github/workflows/build-linux-armv7l.yml | 6 +++--- .github/workflows/build-linux-hosts.yml | 8 ++++---- .github/workflows/build-linux-i686.yml | 4 ++-- .github/workflows/build-linux-loong64.yml | 4 ++-- .github/workflows/build-linux-vms.yml | 6 +++--- .github/workflows/build-macos-hosts.yml | 4 ++-- .github/workflows/build-musl-amd64.yml | 6 +++--- .github/workflows/build-netbsd-amd64.yml | 6 +++--- .github/workflows/build-no-features-test.yml | 2 +- .github/workflows/build-omnios-amd64.yml | 6 +++--- .github/workflows/build-openbsd-amd64.yml | 6 +++--- .github/workflows/build-release.yml | 8 ++++---- .github/workflows/build-solaris-amd64.yml | 6 +++--- .github/workflows/build-spellcheck.yml | 2 +- .github/workflows/build-windows-hosts.yml | 10 +++++----- 18 files changed, 51 insertions(+), 51 deletions(-) diff --git a/.github/workflows/build-dragonfly-amd64.yml b/.github/workflows/build-dragonfly-amd64.yml index a9e62fd0ec..c4b39ecc77 100644 --- a/.github/workflows/build-dragonfly-amd64.yml +++ b/.github/workflows/build-dragonfly-amd64.yml @@ -12,10 +12,10 @@ jobs: steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Start VM - uses: cross-platform-actions/action@master + uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0 with: operating_system: dragonflybsd version: '6.4.2' @@ -57,7 +57,7 @@ jobs: run: ctest --output-on-failure - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-dragonfly-amd64 path: ./fastfetch-*.* diff --git a/.github/workflows/build-freebsd-amd64.yml b/.github/workflows/build-freebsd-amd64.yml index a6af2cba09..ad65c808d0 100644 --- a/.github/workflows/build-freebsd-amd64.yml +++ b/.github/workflows/build-freebsd-amd64.yml @@ -12,10 +12,10 @@ jobs: steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Start VM - uses: cross-platform-actions/action@master + uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0 with: operating_system: freebsd version: '15.1' @@ -58,7 +58,7 @@ jobs: run: ctest --output-on-failure - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-freebsd-amd64 path: ./fastfetch-*.* diff --git a/.github/workflows/build-haiku-amd64.yml b/.github/workflows/build-haiku-amd64.yml index a50550af85..8b9b6cacf1 100644 --- a/.github/workflows/build-haiku-amd64.yml +++ b/.github/workflows/build-haiku-amd64.yml @@ -12,10 +12,10 @@ jobs: steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Start VM - uses: cross-platform-actions/action@master + uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0 with: operating_system: haiku version: 'r1beta5' @@ -51,7 +51,7 @@ jobs: run: ctest --output-on-failure - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-haiku-amd64 path: ./fastfetch-*.* diff --git a/.github/workflows/build-linux-armv7l.yml b/.github/workflows/build-linux-armv7l.yml index fd73e8a6f7..4a1f017d6a 100644 --- a/.github/workflows/build-linux-armv7l.yml +++ b/.github/workflows/build-linux-armv7l.yml @@ -11,10 +11,10 @@ jobs: runs-on: ubuntu-24.04 steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: run VM - uses: uraimo/run-on-arch-action@v3 + uses: uraimo/run-on-arch-action@f9b26e3a1a408d5fd530d20c17b9f3f4428ff8d9 # v3.1.0 id: runcmd with: arch: armv7 @@ -38,7 +38,7 @@ jobs: ctest --output-on-failure - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-linux-armv7l path: ./fastfetch-*.* diff --git a/.github/workflows/build-linux-hosts.yml b/.github/workflows/build-linux-hosts.yml index ae0cec9711..e724146afa 100644 --- a/.github/workflows/build-linux-hosts.yml +++ b/.github/workflows/build-linux-hosts.yml @@ -24,7 +24,7 @@ jobs: ffversion: ${{ steps.ffversion.outputs.ffversion }} steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: uname -a run: uname -a @@ -48,7 +48,7 @@ jobs: - name: Initialize CodeQL if: inputs.arch == 'amd64' - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 with: languages: c @@ -60,7 +60,7 @@ jobs: - name: perform CodeQL analysis if: inputs.arch == 'amd64' - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 - name: list features run: ./fastfetch --list-features @@ -97,7 +97,7 @@ jobs: cpack -V - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-linux-${{ inputs.arch }} path: ./fastfetch-*.* diff --git a/.github/workflows/build-linux-i686.yml b/.github/workflows/build-linux-i686.yml index ed7ab176c3..3f46344f80 100644 --- a/.github/workflows/build-linux-i686.yml +++ b/.github/workflows/build-linux-i686.yml @@ -11,7 +11,7 @@ jobs: runs-on: ubuntu-22.04 steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: uname -a run: uname -a @@ -64,7 +64,7 @@ jobs: run: ctest --output-on-failure - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-linux-i686 path: ./fastfetch-*.* diff --git a/.github/workflows/build-linux-loong64.yml b/.github/workflows/build-linux-loong64.yml index 25b140d8f4..7dea51795c 100644 --- a/.github/workflows/build-linux-loong64.yml +++ b/.github/workflows/build-linux-loong64.yml @@ -11,7 +11,7 @@ jobs: runs-on: ubuntu-24.04 steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: set up QEMU for loong64 uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0 @@ -51,7 +51,7 @@ jobs: ' - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-linux-loong64 path: ./fastfetch-*.* diff --git a/.github/workflows/build-linux-vms.yml b/.github/workflows/build-linux-vms.yml index 49600cb5cf..7a196e0066 100644 --- a/.github/workflows/build-linux-vms.yml +++ b/.github/workflows/build-linux-vms.yml @@ -15,10 +15,10 @@ jobs: runs-on: ubuntu-latest steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: run VM - uses: uraimo/run-on-arch-action@v3 + uses: uraimo/run-on-arch-action@f9b26e3a1a408d5fd530d20c17b9f3f4428ff8d9 # v3.1.0 id: runcmd with: arch: ${{ inputs.arch }} @@ -39,7 +39,7 @@ jobs: ctest --output-on-failure - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-linux-${{ inputs.arch }} path: ./fastfetch-*.* diff --git a/.github/workflows/build-macos-hosts.yml b/.github/workflows/build-macos-hosts.yml index b5fa76a4e3..766fad0c99 100644 --- a/.github/workflows/build-macos-hosts.yml +++ b/.github/workflows/build-macos-hosts.yml @@ -18,7 +18,7 @@ jobs: runs-on: ${{ inputs.runs-on }} steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: uname -a run: uname -a @@ -53,7 +53,7 @@ jobs: run: ctest --output-on-failure - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-macos-${{ inputs.arch }} path: ./fastfetch-*.* diff --git a/.github/workflows/build-musl-amd64.yml b/.github/workflows/build-musl-amd64.yml index 3b4fa86924..da02bcba2b 100644 --- a/.github/workflows/build-musl-amd64.yml +++ b/.github/workflows/build-musl-amd64.yml @@ -10,10 +10,10 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: setup alpine linux - uses: jirutka/setup-alpine@master + uses: jirutka/setup-alpine@ae3b3ddba35054804fc4a3507b519fa7e8152050 # v1.4.1 with: branch: edge @@ -41,7 +41,7 @@ jobs: shell: alpine.sh {0} - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-musl-amd64 path: ./fastfetch-*.* diff --git a/.github/workflows/build-netbsd-amd64.yml b/.github/workflows/build-netbsd-amd64.yml index 96b0ba2cc5..18b5f33a6f 100644 --- a/.github/workflows/build-netbsd-amd64.yml +++ b/.github/workflows/build-netbsd-amd64.yml @@ -12,10 +12,10 @@ jobs: steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Start VM - uses: cross-platform-actions/action@master + uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0 with: operating_system: netbsd version: '10.1' @@ -56,7 +56,7 @@ jobs: run: ctest --output-on-failure - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-netbsd-amd64 path: ./fastfetch-*.* diff --git a/.github/workflows/build-no-features-test.yml b/.github/workflows/build-no-features-test.yml index 2dc5bcd210..a301549d28 100644 --- a/.github/workflows/build-no-features-test.yml +++ b/.github/workflows/build-no-features-test.yml @@ -12,7 +12,7 @@ jobs: steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: uname -a run: uname -a diff --git a/.github/workflows/build-omnios-amd64.yml b/.github/workflows/build-omnios-amd64.yml index 2fc5f6ed51..d2e3931912 100644 --- a/.github/workflows/build-omnios-amd64.yml +++ b/.github/workflows/build-omnios-amd64.yml @@ -12,10 +12,10 @@ jobs: steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Start VM - uses: cross-platform-actions/action@master + uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0 with: operating_system: omnios version: 'r151058' @@ -61,7 +61,7 @@ jobs: cpack -V - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-omnios-amd64 path: ./fastfetch-*.* diff --git a/.github/workflows/build-openbsd-amd64.yml b/.github/workflows/build-openbsd-amd64.yml index bd400f716d..c3240eb360 100644 --- a/.github/workflows/build-openbsd-amd64.yml +++ b/.github/workflows/build-openbsd-amd64.yml @@ -12,10 +12,10 @@ jobs: steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Start VM - uses: cross-platform-actions/action@master + uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0 with: operating_system: openbsd version: '7.9' @@ -56,7 +56,7 @@ jobs: run: ctest --output-on-failure - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-openbsd-amd64 path: ./fastfetch-*.* diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml index 670286d20d..7af70e83d9 100644 --- a/.github/workflows/build-release.yml +++ b/.github/workflows/build-release.yml @@ -13,17 +13,17 @@ jobs: steps: - name: get latest release version id: get_version_release - uses: pozetroninc/github-action-get-latest-release@master + uses: pozetroninc/github-action-get-latest-release@2a61c339ea7ef0a336d1daa35ef0cb1418e7676c # v0.8.0 with: repository: ${{ github.repository }} - name: download artifacts if: inputs.ffversion != steps.get_version_release.outputs.release - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 - name: create release if: inputs.ffversion != steps.get_version_release.outputs.release - uses: ncipollo/release-action@v1 + uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0 with: tag: ${{ inputs.ffversion }} commit: ${{ github.sha }} @@ -50,7 +50,7 @@ jobs: - name: update release body if: inputs.ffversion != steps.get_version_release.outputs.release - uses: ncipollo/release-action@v1 + uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0 with: tag: ${{ inputs.ffversion }} commit: ${{ github.sha }} diff --git a/.github/workflows/build-solaris-amd64.yml b/.github/workflows/build-solaris-amd64.yml index fd5e75894a..806c64df29 100644 --- a/.github/workflows/build-solaris-amd64.yml +++ b/.github/workflows/build-solaris-amd64.yml @@ -11,10 +11,10 @@ jobs: runs-on: ubuntu-latest steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: run VM - uses: vmactions/solaris-vm@v1 + uses: vmactions/solaris-vm@315163f088b66e55bbcc45928bd224d4973b2312 # v1.3.8 with: usesh: true envs: 'CMAKE_BUILD_TYPE' @@ -37,7 +37,7 @@ jobs: cpack -V - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-solaris-amd64 path: ./fastfetch-*.* diff --git a/.github/workflows/build-spellcheck.yml b/.github/workflows/build-spellcheck.yml index ade30a6ceb..da6443e289 100644 --- a/.github/workflows/build-spellcheck.yml +++ b/.github/workflows/build-spellcheck.yml @@ -9,7 +9,7 @@ jobs: steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install codespell shell: bash diff --git a/.github/workflows/build-windows-hosts.yml b/.github/workflows/build-windows-hosts.yml index b2bb9c0eb2..f36e007e0f 100644 --- a/.github/workflows/build-windows-hosts.yml +++ b/.github/workflows/build-windows-hosts.yml @@ -30,10 +30,10 @@ jobs: shell: msys2 {0} steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: setup-msys2 - uses: msys2/setup-msys2@v2 + uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0 with: msystem: ${{ inputs.msystem }} update: true @@ -72,7 +72,7 @@ jobs: - if: github.event_name == 'push' && github.repository == 'fastfetch-cli/fastfetch' id: upload-unsigned-artifact name: upload artifacts for signing - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-windows-${{ inputs.arch }} path: | @@ -82,7 +82,7 @@ jobs: - if: github.event_name == 'push' && github.repository == 'fastfetch-cli/fastfetch' name: submit signing request - uses: signpath/github-action-submit-signing-request@v1 + uses: signpath/github-action-submit-signing-request@ced31329c0317e779dad2eec2a7c3bb46ea1343e # v1.3 with: api-token: '${{ secrets.SIGNPATH_API_TOKEN }}' organization-id: '${{ vars.SIGNPATH_ORG_ID }}' @@ -99,7 +99,7 @@ jobs: run: 7z a -t7z -mx9 -bd -y fastfetch-windows-${{ inputs.arch }}.7z LICENSE *.dll fastfetch.exe flashfetch.exe presets - name: upload true artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-windows-${{ inputs.arch }} path: ./fastfetch-windows-${{ inputs.arch }}.* From 509b79d65550f909fbd86bfb1264be0bd242d5cf Mon Sep 17 00:00:00 2001 From: Thibaud-Vdb Date: Tue, 4 Aug 2026 17:02:43 +0200 Subject: [PATCH 2/3] CI: passes only the secret each reusable workflow needs Every reusable workflow call used 'secrets: inherit', which hands the caller's whole secret set to the called workflow, but the only secret any of them reads is SIGNPATH_API_TOKEN in build-windows-hosts.yml. Passing that one secret explicitly and dropping inherit everywhere else means a compromised step in, say, a BSD build VM has no signing token to steal, and the workflow files now show exactly which secret flows where. The secret is declared optional in the reusable workflow so runs without it (pull requests, forks) behave as before; the signing step is already guarded to upstream push events. --- .github/workflows/build-windows-hosts.yml | 6 ++++++ .github/workflows/ci.yml | 19 ++----------------- 2 files changed, 8 insertions(+), 17 deletions(-) diff --git a/.github/workflows/build-windows-hosts.yml b/.github/workflows/build-windows-hosts.yml index f36e007e0f..6c3007d713 100644 --- a/.github/workflows/build-windows-hosts.yml +++ b/.github/workflows/build-windows-hosts.yml @@ -18,6 +18,12 @@ on: msys-arch: required: true type: string + secrets: + SIGNPATH_API_TOKEN: + description: SignPath REST API token used to submit the signing request + # Optional so that runs without the secret (pull requests, forks) + # still work; the signing step is skipped there anyway. + required: false env: CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 46ac9d4fab..ee3fc872e7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,7 +15,6 @@ jobs: security-events: write contents: read uses: ./.github/workflows/build-no-features-test.yml - secrets: inherit linux-hosts: needs: no-features-test @@ -34,7 +33,6 @@ jobs: with: arch: ${{ matrix.arch }} runs-on: ${{ matrix.runs-on }} - secrets: inherit linux-i686: needs: no-features-test @@ -43,7 +41,6 @@ jobs: security-events: write contents: read uses: ./.github/workflows/build-linux-i686.yml - secrets: inherit linux-armv7l: needs: no-features-test @@ -52,7 +49,6 @@ jobs: security-events: write contents: read uses: ./.github/workflows/build-linux-armv7l.yml - secrets: inherit linux-loong64: needs: no-features-test @@ -61,7 +57,6 @@ jobs: security-events: write contents: read uses: ./.github/workflows/build-linux-loong64.yml - secrets: inherit linux-vms: needs: no-features-test @@ -78,13 +73,11 @@ jobs: uses: ./.github/workflows/build-linux-vms.yml with: arch: ${{ matrix.arch }} - secrets: inherit musl-amd64: needs: no-features-test name: Musl-amd64 uses: ./.github/workflows/build-musl-amd64.yml - secrets: inherit macos-hosts: needs: no-features-test @@ -103,19 +96,16 @@ jobs: with: arch: ${{ matrix.arch }} runs-on: ${{ matrix.runs-on }} - secrets: inherit omnios-amd64: needs: no-features-test name: OmniOS-amd64 uses: ./.github/workflows/build-omnios-amd64.yml - secrets: inherit solaris-amd64: needs: no-features-test name: Solaris-amd64 uses: ./.github/workflows/build-solaris-amd64.yml - secrets: inherit freebsd-amd64: needs: no-features-test @@ -124,7 +114,6 @@ jobs: security-events: write contents: read uses: ./.github/workflows/build-freebsd-amd64.yml - secrets: inherit openbsd-amd64: needs: no-features-test @@ -133,7 +122,6 @@ jobs: security-events: write contents: read uses: ./.github/workflows/build-openbsd-amd64.yml - secrets: inherit netbsd-amd64: needs: no-features-test @@ -142,7 +130,6 @@ jobs: security-events: write contents: read uses: ./.github/workflows/build-netbsd-amd64.yml - secrets: inherit dragonfly-amd64: needs: no-features-test @@ -151,7 +138,6 @@ jobs: security-events: write contents: read uses: ./.github/workflows/build-dragonfly-amd64.yml - secrets: inherit haiku-amd64: if: false # Disabled because the Haiku build is currently broken @@ -161,7 +147,6 @@ jobs: security-events: write contents: read uses: ./.github/workflows/build-haiku-amd64.yml - secrets: inherit windows-hosts: needs: no-features-test @@ -189,7 +174,8 @@ jobs: msystem: ${{ matrix.msystem }} msystem-lower: ${{ matrix.msystem-lower }} msys-arch: ${{ matrix.msys-arch }} - secrets: inherit + secrets: + SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }} release: if: github.event_name == 'push' && github.ref == 'refs/heads/master' && github.repository == 'fastfetch-cli/fastfetch' @@ -215,4 +201,3 @@ jobs: uses: ./.github/workflows/build-release.yml with: ffversion: ${{ needs.linux-hosts.outputs.ffversion }} - secrets: inherit From e4f7b11a9b883d1e4b49c958f20cbc191ae4fb92 Mon Sep 17 00:00:00 2001 From: Thibaud-Vdb Date: Tue, 4 Aug 2026 17:04:34 +0200 Subject: [PATCH 3/3] CI: declares least-privilege token permissions Jobs without a permissions block get the repository's default token scope, and reusable workflow calls pass the caller's grants straight through. Scopes are now derived from what each workflow actually does with the token: - every build workflow declares contents: read; none of them writes through the GITHUB_TOKEN. - build-linux-hosts.yml keeps security-events: write for the CodeQL upload; the other callers had that grant too but never upload scanning results, so they drop it. - build-windows-hosts.yml gets actions: read, which the SignPath action documents needing to read job details and download the unsigned artifact. - build-release.yml declares contents: write, matching the grant its caller already makes for creating the release. Runs that execute pull request code now hold a token that can do nothing but read the repository. --- .github/workflows/build-dragonfly-amd64.yml | 3 +++ .github/workflows/build-freebsd-amd64.yml | 3 +++ .github/workflows/build-haiku-amd64.yml | 3 +++ .github/workflows/build-linux-armv7l.yml | 3 +++ .github/workflows/build-linux-hosts.yml | 4 ++++ .github/workflows/build-linux-i686.yml | 3 +++ .github/workflows/build-linux-loong64.yml | 3 +++ .github/workflows/build-linux-vms.yml | 3 +++ .github/workflows/build-macos-hosts.yml | 3 +++ .github/workflows/build-musl-amd64.yml | 3 +++ .github/workflows/build-netbsd-amd64.yml | 3 +++ .github/workflows/build-no-features-test.yml | 3 +++ .github/workflows/build-omnios-amd64.yml | 3 +++ .github/workflows/build-openbsd-amd64.yml | 3 +++ .github/workflows/build-release.yml | 3 +++ .github/workflows/build-solaris-amd64.yml | 3 +++ .github/workflows/build-spellcheck.yml | 3 +++ .github/workflows/build-windows-hosts.yml | 6 +++++ .github/workflows/ci.yml | 23 ++++++++++---------- 19 files changed, 69 insertions(+), 12 deletions(-) diff --git a/.github/workflows/build-dragonfly-amd64.yml b/.github/workflows/build-dragonfly-amd64.yml index c4b39ecc77..c036d0d9d7 100644 --- a/.github/workflows/build-dragonfly-amd64.yml +++ b/.github/workflows/build-dragonfly-amd64.yml @@ -3,6 +3,9 @@ name: Reusable DragonFly amd64 on: workflow_call: +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest diff --git a/.github/workflows/build-freebsd-amd64.yml b/.github/workflows/build-freebsd-amd64.yml index ad65c808d0..b75d67be89 100644 --- a/.github/workflows/build-freebsd-amd64.yml +++ b/.github/workflows/build-freebsd-amd64.yml @@ -3,6 +3,9 @@ name: Reusable FreeBSD amd64 on: workflow_call: +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest diff --git a/.github/workflows/build-haiku-amd64.yml b/.github/workflows/build-haiku-amd64.yml index 8b9b6cacf1..b85fef26e5 100644 --- a/.github/workflows/build-haiku-amd64.yml +++ b/.github/workflows/build-haiku-amd64.yml @@ -3,6 +3,9 @@ name: Reusable Haiku amd64 on: workflow_call: +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest diff --git a/.github/workflows/build-linux-armv7l.yml b/.github/workflows/build-linux-armv7l.yml index 4a1f017d6a..981ab48c47 100644 --- a/.github/workflows/build-linux-armv7l.yml +++ b/.github/workflows/build-linux-armv7l.yml @@ -3,6 +3,9 @@ name: Reusable Linux armv7l on: workflow_call: +permissions: + contents: read + env: CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }} diff --git a/.github/workflows/build-linux-hosts.yml b/.github/workflows/build-linux-hosts.yml index e724146afa..bcd5069c42 100644 --- a/.github/workflows/build-linux-hosts.yml +++ b/.github/workflows/build-linux-hosts.yml @@ -14,6 +14,10 @@ on: description: fastfetch version from linux host build value: ${{ jobs.build.outputs.ffversion }} +permissions: + security-events: write + contents: read + env: CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }} diff --git a/.github/workflows/build-linux-i686.yml b/.github/workflows/build-linux-i686.yml index 3f46344f80..985b3b089b 100644 --- a/.github/workflows/build-linux-i686.yml +++ b/.github/workflows/build-linux-i686.yml @@ -3,6 +3,9 @@ name: Reusable Linux i686 on: workflow_call: +permissions: + contents: read + env: CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }} diff --git a/.github/workflows/build-linux-loong64.yml b/.github/workflows/build-linux-loong64.yml index 7dea51795c..4771515cb8 100644 --- a/.github/workflows/build-linux-loong64.yml +++ b/.github/workflows/build-linux-loong64.yml @@ -3,6 +3,9 @@ name: Reusable Linux loong64 on: workflow_call: +permissions: + contents: read + env: CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }} diff --git a/.github/workflows/build-linux-vms.yml b/.github/workflows/build-linux-vms.yml index 7a196e0066..e61a2c52cb 100644 --- a/.github/workflows/build-linux-vms.yml +++ b/.github/workflows/build-linux-vms.yml @@ -7,6 +7,9 @@ on: required: true type: string +permissions: + contents: read + env: CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }} diff --git a/.github/workflows/build-macos-hosts.yml b/.github/workflows/build-macos-hosts.yml index 766fad0c99..66c1666b79 100644 --- a/.github/workflows/build-macos-hosts.yml +++ b/.github/workflows/build-macos-hosts.yml @@ -10,6 +10,9 @@ on: required: true type: string +permissions: + contents: read + env: CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }} diff --git a/.github/workflows/build-musl-amd64.yml b/.github/workflows/build-musl-amd64.yml index da02bcba2b..07fad3a7f8 100644 --- a/.github/workflows/build-musl-amd64.yml +++ b/.github/workflows/build-musl-amd64.yml @@ -3,6 +3,9 @@ name: Reusable Musl amd64 on: workflow_call: +permissions: + contents: read + env: CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }} diff --git a/.github/workflows/build-netbsd-amd64.yml b/.github/workflows/build-netbsd-amd64.yml index 18b5f33a6f..9a6283a067 100644 --- a/.github/workflows/build-netbsd-amd64.yml +++ b/.github/workflows/build-netbsd-amd64.yml @@ -3,6 +3,9 @@ name: Reusable NetBSD amd64 on: workflow_call: +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest diff --git a/.github/workflows/build-no-features-test.yml b/.github/workflows/build-no-features-test.yml index a301549d28..fadefe8b9d 100644 --- a/.github/workflows/build-no-features-test.yml +++ b/.github/workflows/build-no-features-test.yml @@ -3,6 +3,9 @@ name: Reusable No Features Test on: workflow_call: +permissions: + contents: read + env: CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }} diff --git a/.github/workflows/build-omnios-amd64.yml b/.github/workflows/build-omnios-amd64.yml index d2e3931912..a473b0817a 100644 --- a/.github/workflows/build-omnios-amd64.yml +++ b/.github/workflows/build-omnios-amd64.yml @@ -3,6 +3,9 @@ name: Reusable OmniOS amd64 on: workflow_call: +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest diff --git a/.github/workflows/build-openbsd-amd64.yml b/.github/workflows/build-openbsd-amd64.yml index c3240eb360..a22919f69d 100644 --- a/.github/workflows/build-openbsd-amd64.yml +++ b/.github/workflows/build-openbsd-amd64.yml @@ -3,6 +3,9 @@ name: Reusable OpenBSD amd64 on: workflow_call: +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml index 7af70e83d9..c5ca7071ac 100644 --- a/.github/workflows/build-release.yml +++ b/.github/workflows/build-release.yml @@ -7,6 +7,9 @@ on: required: true type: string +permissions: + contents: write + jobs: release: runs-on: ubuntu-latest diff --git a/.github/workflows/build-solaris-amd64.yml b/.github/workflows/build-solaris-amd64.yml index 806c64df29..c8e6256201 100644 --- a/.github/workflows/build-solaris-amd64.yml +++ b/.github/workflows/build-solaris-amd64.yml @@ -3,6 +3,9 @@ name: Reusable Solaris amd64 on: workflow_call: +permissions: + contents: read + env: CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }} diff --git a/.github/workflows/build-spellcheck.yml b/.github/workflows/build-spellcheck.yml index da6443e289..e57c92218b 100644 --- a/.github/workflows/build-spellcheck.yml +++ b/.github/workflows/build-spellcheck.yml @@ -3,6 +3,9 @@ name: Reusable Spellcheck on: workflow_call: +permissions: + contents: read + jobs: spellcheck: runs-on: ubuntu-latest diff --git a/.github/workflows/build-windows-hosts.yml b/.github/workflows/build-windows-hosts.yml index 6c3007d713..18708f55f3 100644 --- a/.github/workflows/build-windows-hosts.yml +++ b/.github/workflows/build-windows-hosts.yml @@ -25,6 +25,12 @@ on: # still work; the signing step is skipped there anyway. required: false +permissions: + contents: read + # The SignPath action reads job details and downloads the unsigned + # artifact with the workflow token. + actions: read + env: CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ee3fc872e7..0081e62d88 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,13 +6,14 @@ on: jobs: spellcheck: + permissions: + contents: read uses: ./.github/workflows/build-spellcheck.yml no-features-test: needs: spellcheck name: No-features-test permissions: - security-events: write contents: read uses: ./.github/workflows/build-no-features-test.yml @@ -38,7 +39,6 @@ jobs: needs: no-features-test name: Linux-i686 permissions: - security-events: write contents: read uses: ./.github/workflows/build-linux-i686.yml @@ -46,7 +46,6 @@ jobs: needs: no-features-test name: Linux-armv7l permissions: - security-events: write contents: read uses: ./.github/workflows/build-linux-armv7l.yml @@ -54,7 +53,6 @@ jobs: needs: no-features-test name: Linux-loong64 permissions: - security-events: write contents: read uses: ./.github/workflows/build-linux-loong64.yml @@ -62,7 +60,6 @@ jobs: needs: no-features-test name: Linux-${{ matrix.arch }} permissions: - security-events: write contents: read strategy: matrix: @@ -77,13 +74,14 @@ jobs: musl-amd64: needs: no-features-test name: Musl-amd64 + permissions: + contents: read uses: ./.github/workflows/build-musl-amd64.yml macos-hosts: needs: no-features-test name: macOS-${{ matrix.arch }} permissions: - security-events: write contents: read strategy: matrix: @@ -100,18 +98,21 @@ jobs: omnios-amd64: needs: no-features-test name: OmniOS-amd64 + permissions: + contents: read uses: ./.github/workflows/build-omnios-amd64.yml solaris-amd64: needs: no-features-test name: Solaris-amd64 + permissions: + contents: read uses: ./.github/workflows/build-solaris-amd64.yml freebsd-amd64: needs: no-features-test name: FreeBSD-amd64 permissions: - security-events: write contents: read uses: ./.github/workflows/build-freebsd-amd64.yml @@ -119,7 +120,6 @@ jobs: needs: no-features-test name: OpenBSD-amd64 permissions: - security-events: write contents: read uses: ./.github/workflows/build-openbsd-amd64.yml @@ -127,7 +127,6 @@ jobs: needs: no-features-test name: NetBSD-amd64 permissions: - security-events: write contents: read uses: ./.github/workflows/build-netbsd-amd64.yml @@ -135,7 +134,6 @@ jobs: needs: no-features-test name: DragonFly-amd64 permissions: - security-events: write contents: read uses: ./.github/workflows/build-dragonfly-amd64.yml @@ -144,7 +142,6 @@ jobs: needs: no-features-test name: Haiku-amd64 permissions: - security-events: write contents: read uses: ./.github/workflows/build-haiku-amd64.yml @@ -152,8 +149,10 @@ jobs: needs: no-features-test name: Windows-${{ matrix.arch }} permissions: - security-events: write contents: read + # The SignPath action reads job details and downloads the unsigned + # artifact with the workflow token. + actions: read strategy: matrix: include: