From 9a37be34a1f80b28ae1ab98022cd523940a1f8df Mon Sep 17 00:00:00 2001 From: Thibaud-Vdb Date: Mon, 19 Oct 2026 14:37:13 +0200 Subject: [PATCH 1/4] Pin the third-party actions by commit A tag is a movable pointer: whoever controls one of these repositories can move it, and the next run picks the new code up with the Docker Hub login, the PyPI and crates.io trusted publishers and the Homebrew app key in reach. The tj-actions incident (CVE-2025-30066) went through exactly that door. Every third-party reference now names the commit its tag resolves to, with the tag kept as a comment so the version stays readable and Dependabot keeps bumping it. The two branch references, the PyPI publisher on release/v1 and the crates.io auth action on v1, are pinned to the releases those branches point at, and the review agent moves from main to its latest release. GitHub's own actions stay on their tags. --- .github/workflows/bonk.yml | 2 +- .github/workflows/ci.yaml | 62 +++++++++---------- .github/workflows/docs.yaml | 2 +- .github/workflows/mirror-cog-base-images.yaml | 2 +- .github/workflows/new-pr-review.yml | 2 +- .github/workflows/release-build.yaml | 10 +-- .github/workflows/release-publish.yaml | 8 +-- .github/workflows/rust-advisories.yaml | 2 +- .../update-compatibility-matrices.yaml | 4 +- 9 files changed, 47 insertions(+), 47 deletions(-) diff --git a/.github/workflows/bonk.yml b/.github/workflows/bonk.yml index e3952456d2..e3e5acc5c6 100644 --- a/.github/workflows/bonk.yml +++ b/.github/workflows/bonk.yml @@ -29,7 +29,7 @@ jobs: fetch-depth: 1 - name: Run Bonk - uses: ask-bonk/ask-bonk/github@main + uses: ask-bonk/ask-bonk/github@14a1af226388b15b389a0c1b7df9168a940165b6 # v0.5.1 env: CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} CF_GATEWAY_BASE_URL: https://gateway.ai.cloudflare.com/v1/${{ vars.CLOUDFLARE_ACCOUNT_ID }}/${{ vars.CLOUDFLARE_GATEWAY_ID }}/compat diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 811b6cb555..f85ac6feb3 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -162,7 +162,7 @@ jobs: - uses: actions/checkout@v7 with: fetch-depth: 0 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -182,7 +182,7 @@ jobs: - uses: actions/checkout@v7 with: fetch-depth: 0 - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: workspaces: crates -> target save-if: ${{ github.ref == 'refs/heads/main' }} @@ -191,7 +191,7 @@ jobs: # produces an ABI3 wheel (cp310-abi3). Without this, maturin picks up # the container's default Python (3.8), which doesn't support ABI3. - name: Build coglet wheel (ABI3) - uses: PyO3/maturin-action@v1 + uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0 with: target: x86_64-unknown-linux-gnu args: --release --out dist -m crates/coglet-python/Cargo.toml --interpreter python${{ env.MINIMUM_PYTHON }} @@ -215,7 +215,7 @@ jobs: - uses: actions/checkout@v7 with: fetch-depth: 0 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -223,7 +223,7 @@ jobs: id: version run: echo "version=$(tr -d '[:space:]' < VERSION.txt)" >> "$GITHUB_OUTPUT" - name: Build cog binary - uses: goreleaser/goreleaser-action@v7 + uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0 with: version: '~> v2' args: build --clean --snapshot --single-target --id cog --output cog @@ -245,7 +245,7 @@ jobs: timeout-minutes: 15 steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -272,7 +272,7 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -285,7 +285,7 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -300,7 +300,7 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -313,7 +313,7 @@ jobs: timeout-minutes: 5 steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -335,12 +335,12 @@ jobs: id: setup-python with: python-version: ${{ env.PYTHON_VERSION }} - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: workspaces: crates -> target save-if: ${{ github.ref == 'refs/heads/main' }} key: py-${{ steps.setup-python.outputs.python-version }} - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -364,7 +364,7 @@ jobs: timeout-minutes: 15 steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -377,11 +377,11 @@ jobs: timeout-minutes: 15 steps: - uses: actions/checkout@v7 - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: workspaces: crates -> target save-if: ${{ github.ref == 'refs/heads/main' }} - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -396,7 +396,7 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -414,7 +414,7 @@ jobs: continue-on-error: true steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -439,7 +439,7 @@ jobs: path: dist - name: Extract source distribution run: tar xf dist/*.tar.gz --strip-components=1 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -454,7 +454,7 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -475,7 +475,7 @@ jobs: runs-on: ${{ matrix.platform }} steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -504,7 +504,7 @@ jobs: CGO_ENABLED: "1" steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -517,11 +517,11 @@ jobs: timeout-minutes: 15 steps: - uses: actions/checkout@v7 - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: workspaces: crates -> target save-if: ${{ github.ref == 'refs/heads/main' }} - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -545,7 +545,7 @@ jobs: merge-multiple: true - name: Extract source distribution run: tar xf dist/*.tar.gz --strip-components=1 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -572,11 +572,11 @@ jobs: with: name: CogletRustWheel path: dist - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: workspaces: crates -> target save-if: ${{ github.ref == 'refs/heads/main' }} - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -682,7 +682,7 @@ jobs: with: fetch-depth: 0 - name: Login to Docker Hub - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 if: github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request' with: registry: index.docker.io @@ -697,7 +697,7 @@ jobs: run: | cp dist/cog ./cog chmod +x ./cog - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -859,17 +859,17 @@ jobs: - uses: actions/checkout@v7 with: fetch-depth: 0 - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: workspaces: crates -> target save-if: ${{ github.ref == 'refs/heads/main' }} - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} - name: Check coglet crates.io publish run: cargo publish --dry-run -p coglet --manifest-path crates/Cargo.toml - - uses: goreleaser/goreleaser-action@v7 + - uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0 with: version: '~> v2' args: check diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index a87b7693bf..5053d3315d 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-docs-${{ github.job }} diff --git a/.github/workflows/mirror-cog-base-images.yaml b/.github/workflows/mirror-cog-base-images.yaml index 008537b9cc..9cf8ece2f4 100644 --- a/.github/workflows/mirror-cog-base-images.yaml +++ b/.github/workflows/mirror-cog-base-images.yaml @@ -24,7 +24,7 @@ jobs: steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-mirror-${{ github.job }} diff --git a/.github/workflows/new-pr-review.yml b/.github/workflows/new-pr-review.yml index 617f9ce9f5..c51f36e602 100644 --- a/.github/workflows/new-pr-review.yml +++ b/.github/workflows/new-pr-review.yml @@ -35,7 +35,7 @@ jobs: } >> "$GITHUB_OUTPUT" - name: Run Bonk - uses: ask-bonk/ask-bonk/github@main + uses: ask-bonk/ask-bonk/github@14a1af226388b15b389a0c1b7df9168a940165b6 # v0.5.1 env: CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} CF_GATEWAY_BASE_URL: https://gateway.ai.cloudflare.com/v1/${{ vars.CLOUDFLARE_ACCOUNT_ID }}/${{ vars.CLOUDFLARE_GATEWAY_ID }}/compat diff --git a/.github/workflows/release-build.yaml b/.github/workflows/release-build.yaml index b510ea18ef..016e989c9a 100644 --- a/.github/workflows/release-build.yaml +++ b/.github/workflows/release-build.yaml @@ -127,7 +127,7 @@ jobs: with: fetch-depth: 0 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-rel-${{ github.job }} @@ -277,14 +277,14 @@ jobs: with: fetch-depth: 0 - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: workspaces: crates -> target key: release-${{ matrix.target }} # maturin-action bundles maturin, zig, and Rust inside a manylinux container - name: Build coglet wheel - uses: PyO3/maturin-action@v1 + uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0 with: target: ${{ matrix.target }} manylinux: ${{ matrix.manylinux }} @@ -312,7 +312,7 @@ jobs: with: fetch-depth: 0 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-rel-${{ github.job }} @@ -334,7 +334,7 @@ jobs: # Goreleaser builds CLI binaries and creates draft release - name: Build CLI and create draft release - uses: goreleaser/goreleaser-action@v7 + uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0 with: version: '~> v2' args: release --clean diff --git a/.github/workflows/release-publish.yaml b/.github/workflows/release-publish.yaml index dcb0e4f006..2503d2c69d 100644 --- a/.github/workflows/release-publish.yaml +++ b/.github/workflows/release-publish.yaml @@ -96,7 +96,7 @@ jobs: GH_TOKEN: ${{ github.token }} - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 publish-crates-io: name: Publish coglet to crates.io @@ -113,11 +113,11 @@ jobs: with: ref: ${{ github.event.release.tag_name }} - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-pub-${{ github.job }} - - uses: rust-lang/crates-io-auth-action@v1 + - uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5 id: auth - name: Publish to crates.io @@ -143,7 +143,7 @@ jobs: GH_TOKEN: ${{ github.token }} - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 update-homebrew-tap: name: Update Homebrew cask diff --git a/.github/workflows/rust-advisories.yaml b/.github/workflows/rust-advisories.yaml index 6a464e2826..865efd20a6 100644 --- a/.github/workflows/rust-advisories.yaml +++ b/.github/workflows/rust-advisories.yaml @@ -19,7 +19,7 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} diff --git a/.github/workflows/update-compatibility-matrices.yaml b/.github/workflows/update-compatibility-matrices.yaml index f27d297242..0d1e9f6dde 100644 --- a/.github/workflows/update-compatibility-matrices.yaml +++ b/.github/workflows/update-compatibility-matrices.yaml @@ -25,7 +25,7 @@ jobs: uses: actions/checkout@v7 - name: Install tools - uses: jdx/mise-action@v4 + uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache: true @@ -36,7 +36,7 @@ jobs: - name: Open pull request for changes id: cpr - uses: peter-evans/create-pull-request@v8 + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: branch: chore/update-compatibility-matrices delete-branch: true From 557efb77dde36cf21daaffcba9aaf51bf2e51a46 Mon Sep 17 00:00:00 2001 From: Thibaud-Vdb Date: Mon, 19 Oct 2026 14:37:13 +0200 Subject: [PATCH 2/4] Pass the Homebrew tap update its one secret by name secrets: inherit hands the called workflow every secret the repository holds, the Docker Hub login and the Cloudflare token included. The tap update uses the Homebrew app key and nothing else, so the release publish now names that one secret and the reusable workflow declares it as its input. The manual run reads it directly as before. --- .github/workflows/homebrew-tap.yaml | 3 +++ .github/workflows/release-publish.yaml | 3 ++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/homebrew-tap.yaml b/.github/workflows/homebrew-tap.yaml index a629a82ae9..06dafa2683 100644 --- a/.github/workflows/homebrew-tap.yaml +++ b/.github/workflows/homebrew-tap.yaml @@ -24,6 +24,9 @@ on: description: "Release tag (e.g., v1.0.0)" required: true type: string + secrets: + COG_HOMEBREW_TAP_PRIVATE_KEY: + required: true permissions: contents: read diff --git a/.github/workflows/release-publish.yaml b/.github/workflows/release-publish.yaml index 2503d2c69d..bd2b0781e3 100644 --- a/.github/workflows/release-publish.yaml +++ b/.github/workflows/release-publish.yaml @@ -155,4 +155,5 @@ jobs: uses: ./.github/workflows/homebrew-tap.yaml with: tag: ${{ github.event.release.tag_name }} - secrets: inherit + secrets: + COG_HOMEBREW_TAP_PRIVATE_KEY: ${{ secrets.COG_HOMEBREW_TAP_PRIVATE_KEY }} From 8df2fe757c2390abe14e62069adf70fae61f3cbe Mon Sep 17 00:00:00 2001 From: Thibaud-Vdb Date: Mon, 19 Oct 2026 14:37:14 +0200 Subject: [PATCH 3/4] Declare the token scope of the docs deployment The docs workflow was the one job without a permissions block, so it ran with the repository default. It pushes the built site to gh-pages with git, which is contents: write and nothing else, and it now says so. --- .github/workflows/docs.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index 5053d3315d..f6769f142b 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -4,6 +4,9 @@ on: push: branches: - main +permissions: + contents: write + env: MISE_LOCKED: "1" From 3edf1070d0d42d1035a06609fe6b1552544627c9 Mon Sep 17 00:00:00 2001 From: Thibaud-Vdb Date: Mon, 19 Oct 2026 14:37:14 +0200 Subject: [PATCH 4/4] Stop persisting the checkout token where no step pushes with git actions/checkout writes the job token into .git/config unless told not to, so every later step in the job can read it. The CI matrix, CodeQL, the mirror, the advisory check, the release build and publish and the PR review (which runs with NO_PUSH) never push from their checkout, so those checkouts now opt out. Four keep the token: the docs deploy, the Bonk agent with write permissions, the Homebrew tap update and the compatibility-matrix pull request, each pushes from its tree. --- .github/workflows/ci.yaml | 38 +++++++++++++++++++ .github/workflows/codeql.yml | 2 + .github/workflows/mirror-cog-base-images.yaml | 2 + .github/workflows/new-pr-review.yml | 1 + .github/workflows/release-build.yaml | 4 ++ .github/workflows/release-publish.yaml | 1 + .github/workflows/rust-advisories.yaml | 2 + 7 files changed, 50 insertions(+) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index f85ac6feb3..047ed287e2 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -64,6 +64,7 @@ jobs: steps: - uses: actions/checkout@v7 with: + persist-credentials: false fetch-depth: 0 - run: echo "supported_pythons=$SUPPORTED_PYTHONS" - name: Check playground changes @@ -100,6 +101,7 @@ jobs: steps: - uses: actions/checkout@v7 with: + persist-credentials: false fetch-depth: 0 - name: Validate version @@ -161,6 +163,7 @@ jobs: steps: - uses: actions/checkout@v7 with: + persist-credentials: false fetch-depth: 0 - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: @@ -181,6 +184,7 @@ jobs: steps: - uses: actions/checkout@v7 with: + persist-credentials: false fetch-depth: 0 - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: @@ -214,6 +218,7 @@ jobs: steps: - uses: actions/checkout@v7 with: + persist-credentials: false fetch-depth: 0 - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: @@ -245,6 +250,8 @@ jobs: timeout-minutes: 15 steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 @@ -272,6 +279,8 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 @@ -285,6 +294,8 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 @@ -300,6 +311,8 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 @@ -313,6 +326,8 @@ jobs: timeout-minutes: 5 steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 @@ -328,6 +343,8 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@v7 + with: + persist-credentials: false # setup-python provides a shared-library Python (libpython3.x.so) needed # by stub_gen at runtime (PyO3 auto-initialize). mise's # python-build-standalone is statically linked and doesn't ship the .so. @@ -364,6 +381,8 @@ jobs: timeout-minutes: 15 steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 @@ -377,6 +396,8 @@ jobs: timeout-minutes: 15 steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: workspaces: crates -> target @@ -396,6 +417,8 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 @@ -414,6 +437,8 @@ jobs: continue-on-error: true steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 @@ -454,6 +479,8 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 @@ -475,6 +502,8 @@ jobs: runs-on: ${{ matrix.platform }} steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 @@ -504,6 +533,8 @@ jobs: CGO_ENABLED: "1" steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 @@ -517,6 +548,8 @@ jobs: timeout-minutes: 15 steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: workspaces: crates -> target @@ -566,6 +599,7 @@ jobs: steps: - uses: actions/checkout@v7 with: + persist-credentials: false fetch-depth: 0 - name: Download coglet wheel uses: actions/download-artifact@v8 @@ -594,6 +628,8 @@ jobs: shards: ${{ steps.shard.outputs.shards }} steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - name: Compute shards id: shard run: | @@ -680,6 +716,7 @@ jobs: steps: - uses: actions/checkout@v7 with: + persist-credentials: false fetch-depth: 0 - name: Login to Docker Hub uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 @@ -858,6 +895,7 @@ jobs: steps: - uses: actions/checkout@v7 with: + persist-credentials: false fetch-depth: 0 - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index fd36d43ddb..76b76da934 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -39,6 +39,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@v7 + with: + persist-credentials: false # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL diff --git a/.github/workflows/mirror-cog-base-images.yaml b/.github/workflows/mirror-cog-base-images.yaml index 9cf8ece2f4..8ed57961fd 100644 --- a/.github/workflows/mirror-cog-base-images.yaml +++ b/.github/workflows/mirror-cog-base-images.yaml @@ -23,6 +23,8 @@ jobs: packages: write steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: diff --git a/.github/workflows/new-pr-review.yml b/.github/workflows/new-pr-review.yml index c51f36e602..2afbac4ff8 100644 --- a/.github/workflows/new-pr-review.yml +++ b/.github/workflows/new-pr-review.yml @@ -21,6 +21,7 @@ jobs: - name: Checkout repository uses: actions/checkout@v7 with: + persist-credentials: false fetch-depth: 30 - name: Load review prompt diff --git a/.github/workflows/release-build.yaml b/.github/workflows/release-build.yaml index 016e989c9a..46333e719b 100644 --- a/.github/workflows/release-build.yaml +++ b/.github/workflows/release-build.yaml @@ -43,6 +43,7 @@ jobs: steps: - uses: actions/checkout@v7 with: + persist-credentials: false fetch-depth: 0 - name: Verify tag and version @@ -125,6 +126,7 @@ jobs: steps: - uses: actions/checkout@v7 with: + persist-credentials: false fetch-depth: 0 - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 @@ -275,6 +277,7 @@ jobs: steps: - uses: actions/checkout@v7 with: + persist-credentials: false fetch-depth: 0 - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 @@ -310,6 +313,7 @@ jobs: steps: - uses: actions/checkout@v7 with: + persist-credentials: false fetch-depth: 0 - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 diff --git a/.github/workflows/release-publish.yaml b/.github/workflows/release-publish.yaml index bd2b0781e3..c7e1429c57 100644 --- a/.github/workflows/release-publish.yaml +++ b/.github/workflows/release-publish.yaml @@ -111,6 +111,7 @@ jobs: steps: - uses: actions/checkout@v7 with: + persist-credentials: false ref: ${{ github.event.release.tag_name }} - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 diff --git a/.github/workflows/rust-advisories.yaml b/.github/workflows/rust-advisories.yaml index 865efd20a6..1e545da6c2 100644 --- a/.github/workflows/rust-advisories.yaml +++ b/.github/workflows/rust-advisories.yaml @@ -19,6 +19,8 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27