From 9eab958a25672181bd1ab6819606bb0215c93e6c Mon Sep 17 00:00:00 2001 From: Iko Date: Sat, 12 Sep 2026 21:11:42 +0700 Subject: [PATCH] =?UTF-8?q?fix:=20harden=20CI=20workflow=20=E2=80=94=20lea?= =?UTF-8?q?st-privilege=20token,=20timeouts,=20pinned=20ruff?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/ci.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index af57cf4..97bf5b8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,16 +6,21 @@ on: pull_request: branches: [main] +# Least privilege: these jobs only read the repo and run tests. +permissions: + contents: read + jobs: test: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a - uses: astral-sh/setup-uv@094aa226ed0e8f079adf9b0803105ffdac7bb465 with: version: "0.5.x" - run: uv --version - - run: uv tool install ruff@0.16 + - run: uv tool install ruff@0.16.2 - run: ruff --version - name: Install deps run: uv sync --extra dev @@ -31,6 +36,7 @@ jobs: verify: runs-on: ubuntu-latest needs: test + timeout-minutes: 15 steps: - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a @@ -52,6 +58,7 @@ jobs: integration-test: runs-on: ubuntu-latest needs: verify + timeout-minutes: 15 steps: - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a