From 8d28b1474306561d436d7ffa3d569576e1424b2e Mon Sep 17 00:00:00 2001 From: marissalk-glia Date: Wed, 9 Sep 2026 16:51:39 +0300 Subject: [PATCH 1/4] Pin GitHub Actions to commit SHAs A version tag is mutable. Whoever can push to one of these action repos can move the reference to different code, and our next workflow run picks it up. DevHub flags this as a high-severity unpinned_github_actions violation. ruby/setup-ruby@v1 was the weaker of the two. On that repo v1 is a branch rather than a tag, so it is expected to move and nobody would read a move as suspicious. Its head is v1.321.0, which is what the pin records, so the action does not change. Checkout goes from v3.7.0 to v7.0.1. Nothing here depends on the credential handling that changed in v6: no git commands run after checkout, and submodules: true is a no-op because the repo has no .gitmodules. The cost is that setup-ruby no longer tracks its own updates, so a newer Ruby in the matrix may need a bump here too. --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f3d1f44..2969fbf 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,11 +13,11 @@ jobs: matrix: ruby-version: ['2.1'] steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: true - name: Set up Ruby - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 with: ruby-version: ${{ matrix.ruby-version }} bundler-cache: true From 4fbe7734dc6451f176230f8c2b5f2de12ad3453e Mon Sep 17 00:00:00 2001 From: marissalk-glia Date: Thu, 10 Sep 2026 12:53:13 +0300 Subject: [PATCH 2/4] Restrict the CI token to contents: read The workflow has no permissions: block, so the job runs with the repository default token scope. zizmor flags this as excessive-permissions (high), and DevHub reports it. Every step only reads the repo: checkout, setup-ruby, then bundle exec rake. Nothing writes back. --- .github/workflows/ci.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2969fbf..024b11d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,6 +6,9 @@ on: pull_request: branches: [ master ] +permissions: + contents: read + jobs: test: runs-on: ubuntu-latest From ef7acb55be08a7dcb18a02e9cd439c0fcbb90ace Mon Sep 17 00:00:00 2001 From: marissalk-glia Date: Thu, 10 Sep 2026 12:53:22 +0300 Subject: [PATCH 3/4] Stop persisting credentials in both checkouts Checkout leaves the job token in the workspace git config, so zizmor raises an artipacked finding on each workflow and DevHub reports both. Neither job uses those credentials. The Ruby build only reads. submodules: true is a no-op, since there is no .gitmodules and no gitlink entry in the index. bundler-cache: true makes setup-ruby run bundle install, and the Gemfile has no git sources. The gemspec shells out to git ls-files, which is a local read. The gitleaks scan only execs the gitleaks binary against the local clone. It reaches the GitHub API through the GITHUB_TOKEN we pass in env, not through git. --- .github/workflows/ci.yml | 1 + .github/workflows/gitleaks-scan.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 024b11d..875b2a9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,6 +19,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: true + persist-credentials: false - name: Set up Ruby uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 with: diff --git a/.github/workflows/gitleaks-scan.yml b/.github/workflows/gitleaks-scan.yml index bb18705..7a53425 100644 --- a/.github/workflows/gitleaks-scan.yml +++ b/.github/workflows/gitleaks-scan.yml @@ -37,6 +37,7 @@ jobs: uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6 with: fetch-depth: 0 + persist-credentials: false - name: Run Gitleaks uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0 env: From 3037b7ca1d72e180bf6647e08e090735b2785a6a Mon Sep 17 00:00:00 2001 From: marissalk-glia Date: Thu, 10 Sep 2026 12:53:29 +0300 Subject: [PATCH 4/4] Bump the gitleaks checkout to v7.0.1 The scan pinned v6.0.0, one major behind, so DevHub showed it as stale. Both workflows now sit on the same pin. v7's one breaking change does not reach us. It blocks checking out a fork PR head for pull_request_target and workflow_run, and neither workflow uses those triggers. v6.0.0 was also a bad place to sit. GitHub backported that same fork PR block to v6.1.0, so v6.0.0 is the last v6 without the safer default. --- .github/workflows/gitleaks-scan.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/gitleaks-scan.yml b/.github/workflows/gitleaks-scan.yml index 7a53425..489a305 100644 --- a/.github/workflows/gitleaks-scan.yml +++ b/.github/workflows/gitleaks-scan.yml @@ -34,7 +34,7 @@ jobs: pull-requests: write steps: - name: Checkout code - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false