Address security concerns with workflows

Adds permissions in the workflows and pins the third party actions.
github · Dec 18, 2024 · 07858f6 · 07858f6
1 parent acea5bc
commit 07858f6
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 5 deletions.
diff --git a/.github/workflows/fetch-licenses.yaml b/.github/workflows/fetch-licenses.yaml
@@ -13,13 +13,16 @@ on:
 jobs:
     fetch-licenses:
         runs-on: ubuntu-latest
+        permissions:
+          contents: write
+          pull-requests: write
 
         steps:
             - name: Setup Git
               run: |
                   git config --global user.name "GitHub Actions"
                   git config --global user.email "github-actions[bot]@users.noreply.github.com"
-    
+
             - name: Checkout this repository
               uses: actions/checkout@v4
 
@@ -37,7 +40,7 @@ jobs:
             - name: Get date
               id: date
               run: echo "DT_STAMP"=$(date +'%Y-%m-%d %H:%M UTC') >> $GITHUB_ENV
-    
+
             - name: Check for changes
               id: changes
               run: |
@@ -54,7 +57,7 @@ jobs:
                     fi
                   fi
                   echo "HAS_CHANGES"=$has_changes >> $GITHUB_ENV
-                
+
             - name: Run license extraction
               if: ${{ env.HAS_CHANGES == 'true' || github.event.inputs.force_run == 'true' }}
               run: |
@@ -66,7 +69,7 @@ jobs:
 
             - name: Create Pull Request
               if: ${{ env.HAS_CHANGES == 'true' || github.event.inputs.force_run == 'true' }}
-              uses: peter-evans/create-pull-request@v7
+              uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f
               with:
                   token: ${{ secrets.GITHUB_TOKEN }}
                   commit-message: Add updated license files

diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
@@ -5,6 +5,9 @@ on:
     branches: [main]
   pull_request: {}
 
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy:
@@ -18,7 +21,7 @@ jobs:
           go-version: "1.18.5"
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v6.1.1
+        uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8
         with:
           version: v1.47.3
           args: --verbose --config .golangci.yaml

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
@@ -5,6 +5,9 @@ on:
     branches: [main]
   pull_request: {}
 
+permissions:
+  contents: read
+
 jobs:
   test:
     strategy: