security: harden all workflow files#1019
Conversation
Security Policy Alert: Secret Policy ViolationThis workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch. Secret references detected:
To approve this workflow, please add the Note: The label must be added by someone other than the PR author (cx-luis-ventuzelos) or automation bots to ensure proper security review. After the label is added, you can re-run the blocked workflow to proceed. This workflow will be automatically approved once merged into the default branch. For more information, see StepSecurity's Secret Exfiltration Policy documentation. |
Security Policy Alert: Secret Policy ViolationThis workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch. Secret references detected:
To approve this workflow, please add the Note: The label must be added by someone other than the PR author (cx-luis-ventuzelos) or automation bots to ensure proper security review. After the label is added, you can re-run the blocked workflow to proceed. This workflow will be automatically approved once merged into the default branch. For more information, see StepSecurity's Secret Exfiltration Policy documentation. |
Security Policy Alert: Secret Policy ViolationThis workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch. Secret references detected:
To approve this workflow, please add the Note: The label must be added by someone other than the PR author (cx-luis-ventuzelos) or automation bots to ensure proper security review. After the label is added, you can re-run the blocked workflow to proceed. This workflow will be automatically approved once merged into the default branch. For more information, see StepSecurity's Secret Exfiltration Policy documentation. |
- Fix startup failure: remove unnecessary id-token:write from delete-packages-and-releases.yml - Move permissions to job level across all workflows (least privilege) - Replace PERSONAL_ACCESS_TOKEN with GITHUB_TOKEN everywhere - Fix script injection: move inputs/context expressions to env vars in run steps - Replace deprecated ::set-output with GITHUB_OUTPUT (update-cli.yml) - Update action pins: checkout v6.0.3, setup-node v6.4.0 - Add pull-requests:write to auto-merge and dependabot-merge jobs - Fix PR number injection in ast-cli-team-review.yml
cx-luis-ventuzelos
force-pushed
the
security/harden-all-workflows
branch
from
4335920 to
8a7eb46
Compare
1 participant
Summary
Fixes the startup failure (
id-token: writepermission mismatch) and hardens all remaining workflow files.Applied across all workflows:
PERSONAL_ACCESS_TOKENwithGITHUB_TOKENinputs.*and context expressions toenvvars inrunstepsactions/checkoutv6.0.3,actions/setup-nodev6.4.0pull-requests: writetoauto-merge-pranddependabot-auto-mergejobs${{ github.event.pull_request.number }}injection inast-cli-team-review.yml::set-outputwith$GITHUB_OUTPUTinupdate-cli.yml