From 5a8872f4b4b5fddbc43db4618b03c71b09474c4b Mon Sep 17 00:00:00 2001 From: "hf-security-analysis[bot]" <265538906+hf-security-analysis[bot]@users.noreply.github.com> Date: Thu, 17 Sep 2026 12:14:36 +0000 Subject: [PATCH] fix(ci): harden workflow files flagged on #377 --- .github/workflows/build-push-unity.yml | 8 +++++++- .github/workflows/pip.yml | 8 ++++++-- .github/workflows/quality.yml | 8 ++++++-- .github/workflows/tests-no-deps.yml | 4 ++++ .github/workflows/tests.yml | 10 +++++++--- .github/workflows/wheels.yml | 11 +++++++++-- 6 files changed, 39 insertions(+), 10 deletions(-) diff --git a/.github/workflows/build-push-unity.yml b/.github/workflows/build-push-unity.yml index 89cf5402..f73041a2 100644 --- a/.github/workflows/build-push-unity.yml +++ b/.github/workflows/build-push-unity.yml @@ -14,8 +14,12 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: {} + jobs: buildForAllSupportedPlatforms: + permissions: + contents: read name: Build ${{ matrix.targetPlatform }} runs-on: ubuntu-latest strategy: @@ -84,10 +88,11 @@ jobs: # path: ./builds/Standalone.tar.gz PushToHub: + permissions: {} name: Upload if release needs: [buildForAllSupportedPlatforms] runs-on: ubuntu-latest - # if: github.event_name == 'release' && github.event.action == 'published' + if: github.event_name == 'release' && github.event.action == 'published' steps: - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 @@ -100,6 +105,7 @@ jobs: path: builds - name: Push builds to Hub + if: github.event_name == 'release' && github.event.action == 'published' env: HF_TOKEN: ${{ secrets.UNITY_BUILD_PUSH }} HF_USERNAME: thomwolf diff --git a/.github/workflows/pip.yml b/.github/workflows/pip.yml index bcab360e..0eb108de 100644 --- a/.github/workflows/pip.yml +++ b/.github/workflows/pip.yml @@ -11,8 +11,12 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: {} + jobs: build: + permissions: + contents: read strategy: fail-fast: false matrix: @@ -22,9 +26,9 @@ jobs: runs-on: ${{ matrix.platform }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index c72fcfcd..c2cbef32 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -2,13 +2,17 @@ name: Quality Check on: [pull_request] +permissions: {} + jobs: quality: + permissions: + contents: read runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python 3.8 - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: 3.8 - name: Install Python dependencies diff --git a/.github/workflows/tests-no-deps.yml b/.github/workflows/tests-no-deps.yml index de3e9b73..8b9b8d3c 100644 --- a/.github/workflows/tests-no-deps.yml +++ b/.github/workflows/tests-no-deps.yml @@ -5,8 +5,12 @@ on: [pull_request] env: HF_HOME: ~/hf_cache +permissions: {} + jobs: run-tests: + permissions: + contents: read runs-on: ubuntu-latest strategy: diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index fe5d2db8..098eef2e 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -5,8 +5,12 @@ on: [pull_request] env: HF_HOME: ~/hf_cache +permissions: {} + jobs: run-tests: + permissions: + contents: read runs-on: ubuntu-latest strategy: @@ -21,14 +25,14 @@ jobs: vtk-version: 'latest' steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python-version }} - - uses: actions/cache@v6 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/pip key: Python-${{ runner.os }}-${{ matrix.python-version }}-${{ matrix.vtk-version }}-${{ hashFiles('setup.py') }}-${{ hashFiles('requirements_test.txt') }} diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml index 46231e0b..b35e11c0 100644 --- a/.github/workflows/wheels.yml +++ b/.github/workflows/wheels.yml @@ -14,8 +14,12 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: {} + jobs: build_sdist: + permissions: + contents: read name: Build SDist runs-on: ubuntu-latest steps: @@ -33,6 +37,8 @@ jobs: build_wheels: + permissions: + contents: read name: Wheels on ${{ matrix.os }} runs-on: ${{ matrix.os }} strategy: @@ -43,7 +49,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: pypa/cibuildwheel@v4.2.1 + - uses: pypa/cibuildwheel@e090b81e30c4d855ea63bf4b6e59204c09a101ae # v4.2.1 env: CIBW_ARCHS_MACOS: auto universal2 CIBW_SKIP: cp311-* *-win32 pp38-* pp39-* *_i686 *-musllinux_* cp38-*-universal2 @@ -60,6 +66,7 @@ jobs: upload_all: + permissions: {} name: Upload if release needs: [build_wheels, build_sdist] runs-on: ubuntu-latest @@ -75,7 +82,7 @@ jobs: name: artifact path: dist - - uses: pypa/gh-action-pypi-publish@v1.14.2 + - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 with: user: thomwolf password: ${{ secrets.pypi_password }} \ No newline at end of file