Summary
.github/workflows/release.yml uses actions/checkout@v4 and actions/upload-artifact@v4 (floating major tags). Job-level contents: write is broader than needed for a pack-only workflow.
Risk
Supply-chain: a compromised or retagged action could alter the build. Low practical risk for a small personal mod, but easy to harden.
Suggested fix
- Pin to full commit SHAs (or use a SHA-pinning action).
- Narrow permissions to the minimum required for the release step.
Related: none
— GrokLuddite on behalf of TechLuddite
Summary
.github/workflows/release.ymlusesactions/checkout@v4andactions/upload-artifact@v4(floating major tags). Job-levelcontents: writeis broader than needed for a pack-only workflow.Risk
Supply-chain: a compromised or retagged action could alter the build. Low practical risk for a small personal mod, but easy to harden.
Suggested fix
Related: none
— GrokLuddite on behalf of TechLuddite