ci: pin actions to commit SHAs, scope the publish token, add Dependabot - #27
Merged
Merged
Conversation
Every `uses:` in `ci.yml` and `publish.yml` named a tag or a branch: `actions/checkout@v7`, `Swatinem/rust-cache@v2`, `dtolnay/rust-toolchain@stable` and `@1.95.0`, and `rust-lang/crates-io-auth-action@v1`. A tag or a branch can be moved to point at different code. `publish.yml` runs with `id-token: write` and mints the crates.io publishing token, so whatever those refs pointed at on the day of a release ran with the means to publish. - Third-party actions are pinned to full commit SHAs, with the release each corresponds to in a trailing comment: checkout v7.0.1, rust-cache v2.9.2 and crates-io-auth-action v1.0.5, which is also the commit `v1` pointed at. - `dtolnay/rust-toolchain` is replaced with the runner's own `rustup`. The action is versioned by branch, so there is no release for a pin to name or for Dependabot to follow. Toolchains and components are unchanged. - `ci.yml` declares `permissions: contents: read`. Nothing in it writes. - `publish.yml` grants `id-token: write` to the publish job rather than the whole workflow, and runs that job in the `crates-io` environment. The environment's protection rules are repository settings and binding it in the crate's Trusted Publishing configuration is a crates.io setting; neither is part of this change. Naming the environment first is safe, because a Trusted Publisher with no environment configured accepts a run from any. - Checkouts set `persist-credentials: false`. No job pushes. Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
A SHA pin does not move on its own. Dependabot proposes a new pin, and rewrites the version comment beside it, when an action publishes a release. Weekly for `github-actions`, grouped into a single pull request, and weekly for `cargo`. Both hold a new release back for seven days before proposing it, so a retagged or withdrawn release has time to be noticed; security updates are not held back. Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
uses:in.github/workflows/ci.ymland.github/workflows/publish.ymlto a full 40-character commit SHA, with the corresponding release in a trailing comment.dtolnay/rust-toolchain@stable/@1.95.0(branch refs) with the runner's ownrustup. Toolchains and components are unchanged: stable (withrustfmt/clippyin those jobs) and 1.95.0 for the MSRV job.permissions: contents: readtoci.yml.publish.yml: top-level permissions becomecontents: read;id-token: writeis granted to thepublishjob only; the job runs inenvironment: crates-io.persist-credentials: falseon every checkout (no job pushes)..github/dependabot.yml:github-actionsweekly (grouped,cooldown: default-days: 7,ci(deps)prefix) andcargoweekly (cooldown: default-days: 7,chore(deps)prefix). There was no existing Dependabot config.Pins
gh api repos/<o>/<r>/git/ref/tags/<tag>actions/checkout@v7@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1v7is a lightweight tag on thev7.0.1commitSwatinem/rust-cache@v2@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2v2is an annotated tag (49a0bdc7…), dereferenced to commit6323deb1…=v2.9.2rust-lang/crates-io-auth-action@v1(branch)@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5v1.0.5(lightweight tag); also the current head of branchv1dtolnay/rust-toolchain@stable,@1.95.0(branches)rustup toolchain install <stable|1.95.0> --profile minimal [--component …]thenrustup defaultAdmin follow-up (settings, not code)
crates-io: add required reviewers (e.g.@OpenVTC/openvtc-maintainers, with "Prevent self-review") and a deployment policy limited to tags matchingv*.*.*. If the environment does not exist when the job first runs, GitHub creates it with no protection rules.dtg-credentials): crates.io → the crate → Settings → Trusted Publishing → set Environment tocrates-io. crates.io then issues a publishing token only to a run of this workflow in that environment.Ordering: merge this PR first, then do step 2. Adding
environment: crates-ioto the job before crates.io is told about it is harmless, because a Trusted Publisher with no environment constraint accepts a run from any environment. Doing step 2 first would make the next tag push fail at the auth step.Verification
python3yaml.safe_load(ci.yml,publish.yml,dependabot.yml).git grep -nE 'uses: *[^ .][^ ]*@' -- .github | grep -vE '@[0-9a-f]{40}( |$)'prints nothing.actionlintandzizmorwere not available locally and were not run.ci.ymlchanges.publish.ymlruns only on av*.*.*tag push or a manual dispatch, so its changes are first exercised at the next release.