Repository navigation
ci: pin actions to commits and stop persisting checkout tokens - #10
Merged
Merged
Conversation
Pin every action to the commit its tag resolved to, with the version in a comment, so a moved tag cannot change what runs on the self-hosted runners. Repository settings will require full commit SHAs. Checkouts no longer persist the job token in .git/config, where build and test code could read it; no step pushes with it. Dependabot keeps the pinned actions current, proposing a release only once it is 7 days old.
go-ci-actions v1.1.0 uses the cluster runners' shared, RAM-backed Go build cache when the runner provides one, and keeps only modules in the GitHub cache. Jobs that run it get id-token: write: the cache accepts uploads only with the job's OIDC token, and stores a pull request's in a namespace of its own. Hosted runners keep using the GitHub cache. The release job builds with cache-mode: off: published binaries never come from cached objects, which any repository's default branch can write.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pin every action to the commit its tag resolved to, with the version in a
comment, so a moved tag cannot change what runs on the self-hosted runners.
Repository settings will require full commit SHAs.
Checkouts no longer persist the job token in .git/config, where build and
test code could read it; no step pushes with it.
Dependabot keeps the pinned actions current, proposing a release only once
it is 7 days old.
Moves Go jobs to go-ci-actions v1.1.0 and the cluster runners' shared Go build cache; jobs that run it get
id-token: writeso the cache accepts their uploads. The release job builds withcache-mode: off, so published binaries never come from cached objects.Test plan