fix(ci): harden publish-docs workflow security and update actions - #20
Closed
jmeridth wants to merge 6 commits into
Closed
fix(ci): harden publish-docs workflow security and update actions#20jmeridth wants to merge 6 commits into
jmeridth wants to merge 6 commits into
Conversation
What/Why Reduce blast radius of a compromised action by moving permissions to job level with least-privilege grants, disabling credential persistence on checkout, and pinning all actions to SHA at their latest versions. Proof it works actionlint passes clean. Workflow is push-to-main only so will be validated on merge. Risk + AI role Low -- workflow-only change, no application code affected. All changes AI-generated (Claude Opus 4.6, claude-opus-4-6), human-reviewed. Review focus Verify the major version bumps (checkout v4->v6, setup-uv v5->v8, configure-pages v5->v6, upload-pages-artifact v3->v5, deploy-pages v4->v5) don't introduce breaking changes for this usage. Signed-off-by: jmeridth <jmeridth@gmail.com>
jmeridth
marked this pull request as ready for review
June 18, 2026 03:51
Contributor
|
This looks like a good hardening practice, thank you. Can you test it end-to-end against your fork to ensure the changes actually work? Mention you've done that in this PR and we'll be happy to approve it. |
What/Why Reduce blast radius of a compromised action by moving permissions to job level with least-privilege grants, disabling credential persistence on checkout, and pinning all actions to SHA at their latest versions. Proof it works actionlint passes clean. Workflow is push-to-main only so will be validated on merge. Risk + AI role Low -- workflow-only change, no application code affected. All changes AI-generated (Claude Opus 4.6, claude-opus-4-6), human-reviewed. Review focus Verify the major version bumps (checkout v4->v6, setup-uv v5->v8, configure-pages v5->v6, upload-pages-artifact v3->v5, deploy-pages v4->v5) don't introduce breaking changes for this usage. Signed-off-by: jmeridth <jmeridth@gmail.com>
Signed-off-by: jmeridth <jmeridth@gmail.com>
Contributor
Author
@duncangrist As noted above, this change only works after merge to main (A GitHub Actions "feature"). Still able to test in my fork as requested. I cherry-picked the commit to my fork's main branch and manually ran the workflow here. It succeeded. Had to manually run because it was the first time on the main branch. I updated docs/README.md file and pushed to main to ensure the workflow triggered automatically when push to main in docs folder occurs. Succeeded also. Screenshot from first run and deploy
Screenshot with my test content change - run and deploy
|
duncangrist
approved these changes
Jun 18, 2026
duncangrist
approved these changes
Jun 18, 2026
duncangrist
left a comment
duncangrist
left a comment
Contributor
There was a problem hiding this comment.
These changes are approved, but you won't be able to merge yourself. We're not ready with the contributor merge workflow just yet, but once we are we'll get this one integrated.
Thanks again.
Keep SHA-pinned actions/deploy-pages@v5.0.0 over upstream's unpinned v4 tag reference -- newer version and pinned to SHA for security. Signed-off-by: jmeridth <jmeridth@gmail.com>
subhramit
reviewed
Jul 9, 2026
jmeridth
force-pushed
the
fix/harden-publish-docs-workflow
branch
from
July 11, 2026 16:32
9bd2843 to
b89fca2
Compare
Removed placeholder text from the README file. Signed-off-by: Jason Meridth <jmeridth@gmail.com>
jmeridth
force-pushed
the
fix/harden-publish-docs-workflow
branch
from
July 11, 2026 16:34
b89fca2 to
84d15eb
Compare
concernedrat
added
the
ready-to-import
epic-lore-bot
Bot
added
imported
|
Imported as Lore CR-203. |
epic-lore-bot Bot
pushed a commit
that referenced
this pull request
Jul 14, 2026
Similar to #7 but use full SHAs for actions ## What/Why Reduce blast radius of a compromised action by moving permissions to job level with least-privilege grants, disabling credential persistence on checkout, and pinning all actions to SHA at their latest versions. ## Proof it works actionlint passes clean. Workflow is push-to-main only so will be validated on merge. ## Risk + AI role Low -- workflow-only change, no application code affected. AI-assisted (Claude Opus 4.6). ## Review focus Verify the major version bumps (checkout v4->v6, setup-uv v5->v8, configure-pages v5->v6, upload-pages-artifact v3->v5, deploy-pages v4->v5) don't introduce breaking changes for this usage. ``` Imported-PR: #20 Imported-From: 84d15eb Imported-Base: f3d23d4 Imported-Merge: bf38ee9 Imported-Author: Jason Meridth (jmeridth) Signed-off-by: Jason Meridth <jmeridth@gmail.com> GH-URL: #20 ``` Lore-RevId: 304 Lore-Signature: 916e92b828678bca5fd8cedf22cdbcd1a5c3fc76d3d128abcbd03daf449161c6
|
Closed by mirrored commit d0a32e1. |
Contributor
|
Congratulations @jmeridth - you're the first external collaborator to have their contribution merged into the Lore codebase! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Similar to #7 but use full SHAs for actions
What/Why
Reduce blast radius of a compromised action by moving permissions to job level with least-privilege grants, disabling credential persistence on checkout, and pinning all actions to SHA at their latest versions.
Proof it works
actionlint passes clean. Workflow is push-to-main only so will be validated on merge.
Risk + AI role
Low -- workflow-only change, no application code affected. AI-assisted (Claude Opus 4.6).
Review focus
Verify the major version bumps (checkout v4->v6, setup-uv v5->v8, configure-pages v5->v6, upload-pages-artifact v3->v5, deploy-pages v4->v5) don't introduce breaking changes for this usage.