Skip to content

[SECURITY] Harden GitHub Actions workflows#390

Open
DarthMike wants to merge 1 commit intodevelopfrom
tech/harden-ci-action
Open

[SECURITY] Harden GitHub Actions workflows#390
DarthMike wants to merge 1 commit intodevelopfrom
tech/harden-ci-action

Conversation

@DarthMike
Copy link
Copy Markdown
Member

@DarthMike DarthMike commented Mar 25, 2026

Summary

  • Add least-privilege permissions to CI workflow
  • Pin third-party actions to immutable commit SHAs
  • Protect workflow and CI script changes with stricter CODEOWNERS entries

Implemented following GitHub's Secure use reference. Mirrors argentlabs/ios#7390.

- Add least-privilege permissions to CI workflow
- Pin actions/checkout to immutable commit SHA
- Add CODEOWNERS to protect workflow and CI script changes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@DarthMike DarthMike requested a review from dmcrodrigues March 25, 2026 16:16
@DarthMike DarthMike self-assigned this Mar 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant