Skip to content

CI: hardens the workflows (SHA pins, scoped secrets and token permissions) #2492

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
CarterLi merged 3 commits into from
Aug 6, 2026
Merged

CI: hardens the workflows (SHA pins, scoped secrets and token permissions) #2492

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6202084
CI: pins actions to commit SHAs
Totara-thib Aug 4, 2026
509b79d
CI: passes only the secret each reusable workflow needs
Totara-thib Aug 4, 2026
e4f7b11
CI: declares least-privilege token permissions
Totara-thib Aug 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions .github/workflows/build-dragonfly-amd64.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ name: Reusable DragonFly amd64
on:
workflow_call:

permissions:
contents: read

jobs:
build:
runs-on: ubuntu-latest
Expand All @@ -12,10 +15,10 @@ jobs:

steps:
- name: checkout repository
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Start VM
uses: cross-platform-actions/action@master
uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0
with:
operating_system: dragonflybsd
version: '6.4.2'
Expand Down Expand Up @@ -57,7 +60,7 @@ jobs:
run: ctest --output-on-failure

- name: upload artifacts
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: fastfetch-dragonfly-amd64
path: ./fastfetch-*.*
9 changes: 6 additions & 3 deletions .github/workflows/build-freebsd-amd64.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ name: Reusable FreeBSD amd64
on:
workflow_call:

permissions:
contents: read

jobs:
build:
runs-on: ubuntu-latest
Expand All @@ -12,10 +15,10 @@ jobs:

steps:
- name: checkout repository
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Start VM
uses: cross-platform-actions/action@master
uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0
with:
operating_system: freebsd
version: '15.1'
Expand Down Expand Up @@ -58,7 +61,7 @@ jobs:
run: ctest --output-on-failure

- name: upload artifacts
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: fastfetch-freebsd-amd64
path: ./fastfetch-*.*
9 changes: 6 additions & 3 deletions .github/workflows/build-haiku-amd64.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ name: Reusable Haiku amd64
on:
workflow_call:

permissions:
contents: read

jobs:
build:
runs-on: ubuntu-latest
Expand All @@ -12,10 +15,10 @@ jobs:

steps:
- name: checkout repository
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Start VM
uses: cross-platform-actions/action@master
uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0
with:
operating_system: haiku
version: 'r1beta5'
Expand Down Expand Up @@ -51,7 +54,7 @@ jobs:
run: ctest --output-on-failure

- name: upload artifacts
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: fastfetch-haiku-amd64
path: ./fastfetch-*.*
9 changes: 6 additions & 3 deletions .github/workflows/build-linux-armv7l.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ name: Reusable Linux armv7l
on:
workflow_call:

permissions:
contents: read

env:
CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}

Expand All @@ -11,10 +14,10 @@ jobs:
runs-on: ubuntu-24.04
steps:
- name: checkout repository
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: run VM
uses: uraimo/run-on-arch-action@v3
uses: uraimo/run-on-arch-action@f9b26e3a1a408d5fd530d20c17b9f3f4428ff8d9 # v3.1.0
id: runcmd
with:
arch: armv7
Expand All @@ -38,7 +41,7 @@ jobs:
ctest --output-on-failure

- name: upload artifacts
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: fastfetch-linux-armv7l
path: ./fastfetch-*.*
12 changes: 8 additions & 4 deletions .github/workflows/build-linux-hosts.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,10 @@ on:
description: fastfetch version from linux host build
value: ${{ jobs.build.outputs.ffversion }}

permissions:
security-events: write
contents: read

env:
CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}

Expand All @@ -24,7 +28,7 @@ jobs:
ffversion: ${{ steps.ffversion.outputs.ffversion }}
steps:
- name: checkout repository
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: uname -a
run: uname -a
Expand All @@ -48,7 +52,7 @@ jobs:

- name: Initialize CodeQL
if: inputs.arch == 'amd64'
uses: github/codeql-action/init@v4
uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
with:
languages: c

Expand All @@ -60,7 +64,7 @@ jobs:

- name: perform CodeQL analysis
if: inputs.arch == 'amd64'
uses: github/codeql-action/analyze@v4
uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6

- name: list features
run: ./fastfetch --list-features
Expand Down Expand Up @@ -97,7 +101,7 @@ jobs:
cpack -V

- name: upload artifacts
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: fastfetch-linux-${{ inputs.arch }}
path: ./fastfetch-*.*
7 changes: 5 additions & 2 deletions .github/workflows/build-linux-i686.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ name: Reusable Linux i686
on:
workflow_call:

permissions:
contents: read

env:
CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}

Expand All @@ -11,7 +14,7 @@ jobs:
runs-on: ubuntu-22.04
steps:
- name: checkout repository
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: uname -a
run: uname -a
Expand Down Expand Up @@ -64,7 +67,7 @@ jobs:
run: ctest --output-on-failure

- name: upload artifacts
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: fastfetch-linux-i686
path: ./fastfetch-*.*
7 changes: 5 additions & 2 deletions .github/workflows/build-linux-loong64.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ name: Reusable Linux loong64
on:
workflow_call:

permissions:
contents: read

env:
CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}

Expand All @@ -11,7 +14,7 @@ jobs:
runs-on: ubuntu-24.04
steps:
- name: checkout repository
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: set up QEMU for loong64
uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
Expand Down Expand Up @@ -51,7 +54,7 @@ jobs:
'

- name: upload artifacts
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: fastfetch-linux-loong64
path: ./fastfetch-*.*
9 changes: 6 additions & 3 deletions .github/workflows/build-linux-vms.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,9 @@ on:
required: true
type: string

permissions:
contents: read

env:
CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}

Expand All @@ -15,10 +18,10 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: checkout repository
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: run VM
uses: uraimo/run-on-arch-action@v3
uses: uraimo/run-on-arch-action@f9b26e3a1a408d5fd530d20c17b9f3f4428ff8d9 # v3.1.0
id: runcmd
with:
arch: ${{ inputs.arch }}
Expand All @@ -39,7 +42,7 @@ jobs:
ctest --output-on-failure

- name: upload artifacts
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: fastfetch-linux-${{ inputs.arch }}
path: ./fastfetch-*.*
7 changes: 5 additions & 2 deletions .github/workflows/build-macos-hosts.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,9 @@ on:
required: true
type: string

permissions:
contents: read

env:
CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}

Expand All @@ -18,7 +21,7 @@ jobs:
runs-on: ${{ inputs.runs-on }}
steps:
- name: checkout repository
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: uname -a
run: uname -a
Expand Down Expand Up @@ -53,7 +56,7 @@ jobs:
run: ctest --output-on-failure

- name: upload artifacts
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: fastfetch-macos-${{ inputs.arch }}
path: ./fastfetch-*.*
9 changes: 6 additions & 3 deletions .github/workflows/build-musl-amd64.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,17 +3,20 @@ name: Reusable Musl amd64
on:
workflow_call:

permissions:
contents: read

env:
CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}

jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: setup alpine linux
uses: jirutka/setup-alpine@master
uses: jirutka/setup-alpine@ae3b3ddba35054804fc4a3507b519fa7e8152050 # v1.4.1
with:
branch: edge

Expand Down Expand Up @@ -41,7 +44,7 @@ jobs:
shell: alpine.sh {0}

- name: upload artifacts
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: fastfetch-musl-amd64
path: ./fastfetch-*.*
9 changes: 6 additions & 3 deletions .github/workflows/build-netbsd-amd64.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ name: Reusable NetBSD amd64
on:
workflow_call:

permissions:
contents: read

jobs:
build:
runs-on: ubuntu-latest
Expand All @@ -12,10 +15,10 @@ jobs:

steps:
- name: checkout repository
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Start VM
uses: cross-platform-actions/action@master
uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0
with:
operating_system: netbsd
version: '10.1'
Expand Down Expand Up @@ -56,7 +59,7 @@ jobs:
run: ctest --output-on-failure

- name: upload artifacts
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: fastfetch-netbsd-amd64
path: ./fastfetch-*.*
5 changes: 4 additions & 1 deletion .github/workflows/build-no-features-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ name: Reusable No Features Test
on:
workflow_call:

permissions:
contents: read

env:
CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}

Expand All @@ -12,7 +15,7 @@ jobs:

steps:
- name: checkout repository
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: uname -a
run: uname -a
Expand Down
Loading
Loading