Skip to content

chore: harden GitHub Actions CI#1

Merged
nikuscs merged 1 commit into
mainfrom
security/harden-ci-controls
May 12, 2026
Merged

chore: harden GitHub Actions CI#1
nikuscs merged 1 commit into
mainfrom
security/harden-ci-controls

Conversation

@nikuscs
Copy link
Copy Markdown
Owner

@nikuscs nikuscs commented May 12, 2026

Summary

  • set default workflow permissions to no scopes for CI
  • grant only contents: read to the check job
  • skip PR-triggered CI when the pull request comes from a fork
  • avoid persisting checkout credentials in CI

Verification

  • Parsed workflow YAML locally
  • Ran git diff --check

@nikuscs nikuscs marked this pull request as ready for review May 12, 2026 10:37
@nikuscs nikuscs merged commit cc7706f into main May 12, 2026
1 check passed
@nikuscs nikuscs deleted the security/harden-ci-controls branch May 12, 2026 10:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant