CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-09 22:48:57 +02:00
Code Issues Packages Projects Releases Wiki Activity

ci: least-privilege tokens on the two lanes that execute PR-controlled code

Browse Source 
free-tests runs PR code (install lifecycle scripts + the suite) with
whatever the repo-default GITHUB_TOKEN grant is, persisted into
.git/config by checkout. Now: permissions contents:read,
persist-credentials false, pinned by the wiring test. actionlint gets
the same treatment plus a digest pin on the third-party Docker Hub
image (a tag is repointable with no GitHub-side audit trail, and the
image sees the mounted checkout). restore-keys added to both caches so
a lockfile bump warms from the previous cache; stale --parallel header
wording corrected.
This commit is contained in:
Garry Tan
2026-08-15 16:49:39 -07:00
parent fd47cd8477
commit 7b4b70babd
3 changed files with 38 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/free-tests-workflow-wiring.test.ts
+8
View File
@@ -53,4 +53,12 @@ describe('free-tests workflow wiring', () => {
expect(entries.length).toBe(count);
}
});
test('least-privilege token: contents read-only, credentials not persisted', () => {
// The job executes PR-controlled code (install lifecycle scripts + the
// suite itself). A default-grant GITHUB_TOKEN persisted into .git/config
// by checkout would hand that code whatever the repo default allows.
expect(source).toMatch(/permissions:\s*\n\s*contents:\s*read/);
expect(source).toMatch(/persist-credentials:\s*false/);
});
});