While looking at the workflows I noticed every uses: references a mutable version tag (actions/checkout@v4, softprops/action-gh-release@v2.5.0, etc.) instead of a pinned commit SHA. A compromised tag (it's happened — see the 2025 tj-actions incident) would run in CI/publish with contents: write / id-token: write permissions, so I think it's worth pinning.
I'd pin every uses: in ci.yml and publish.yml to a full commit SHA, e.g.:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
Dependabot (#66) would then keep the SHAs current via PRs.
Split out from #65.
While looking at the workflows I noticed every
uses:references a mutable version tag (actions/checkout@v4,softprops/action-gh-release@v2.5.0, etc.) instead of a pinned commit SHA. A compromised tag (it's happened — see the 2025 tj-actions incident) would run in CI/publish withcontents: write/id-token: writepermissions, so I think it's worth pinning.I'd pin every
uses:inci.ymlandpublish.ymlto a full commit SHA, e.g.:Dependabot (#66) would then keep the SHAs current via PRs.
Split out from #65.