Repository navigation
ci: harden the workflows, stop docs runs cancelling each other - #4
Merged
Merged
Conversation
Jertlok
force-pushed
the
ci/harden-workflows
branch
2 times, most recently
from
September 16, 2026 06:26
6f4f01b to
e8b0b81
Compare
Jertlok
force-pushed
the
ci/harden-workflows
branch
from
September 16, 2026 06:37
ca8bffd to
961cf41
Compare
- CI had no concurrency group: every push to a pull request, and every body edit, left the previous run going. Superseded pull request runs are now cancelled; pushes to main keep theirs. - Docs put every run, pull requests included, in one "pages" group. A pull request's build waited for any other, and GitHub cancels a pending run when a newer one joins its group, so one pull request could cancel another's docs check (run 35028722871). Builds are grouped per pull request; only the deploy job is serialized. - The docs build job held pages: write and id-token: write on every pull request only for configure-pages. That step moves to the deploy job, which runs on main with PUBLISH_DOCS set; builds get a read-only token. - vars.PUBLISH_DOCS reaches the shell through env instead of template substitution (zizmor template-injection). - persist-credentials: false on every checkout (zizmor artipacked), timeouts on every job, runners pinned to ubuntu-24.04, merge_group. - Workflow lint (actionlint, zizmor) and a "CI passed" aggregate job from porthole-dev/.github, as uses: steps so ci.yml still runs nothing but make targets. - Dependabot keeps the pinned actions current, weekly and grouped, with a seven-day cooldown. Assisted-by: Claude Signed-off-by: Giuseppe Maggio <jertlok@proton.me>
The previous pin named a commit from the pull request branch, which the rebase merge orphaned; an orphaned commit can be garbage-collected and the action then stops resolving. Point at the commit main was tagged v1.0.0. Assisted-by: Claude Signed-off-by: Giuseppe Maggio <jertlok@proton.me>
Jertlok
force-pushed
the
ci/harden-workflows
branch
from
September 16, 2026 07:36
961cf41 to
397e48c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
concurrency: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }},cancel-in-progressonly for pull requeststimeout-minuteson every jobmerge_grouptriggerpages: write/id-token: writemoved from the pull request build to the deploy jobpagesgroup made pull requests cancel each other's docs check (run 35028722871 was cancelled that way). GitHub's Pages starter workflow scopes the group to deployment.check-zizmor.yml); both tools are what the OpenSSF Scorecard and GitHub's security hardening guide checks are about (pinning, token permissions, injection)..github/dependabot.yml: GitHub Actions weekly, grouped, 7-day cooldowndependabot-cooldownrecommendation. Dependabot commits need the maintainer's sign-off before merge like any other.persist-credentials: false, least-privilegepermissionsartipacked/excessive-permissions.Depends on
porthole-dev/.githubis private: its Settings > Actions > General > Access set to "Accessible from repositories in the porthole-dev organization". Until then Workflow lint and CI passed fail with "Unable to resolve actionporthole-dev/.github, repository not found".@43919fe... # main) moved to the merged commit and its tag (# v1.0.0); zizmor'sref-version-mismatchwarns until the comment names a tag.Merge note
porthole keeps its own Commit check (make trailers). It fails until the commit carries the maintainer's
Signed-off-by(git rebase --signoff main).