From af3c6c0070741577ef43060c2f4654f3782bd60b Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 15 Apr 2026 20:55:43 +0000 Subject: [PATCH 1/2] ci: pin GitHub Actions to full commit SHAs and restrict token permissions Fixes two supply chain / token security issues: - Pin all third-party Actions to immutable full commit SHAs instead of mutable version tags (addresses unpinned-dependencies risk, analogous to quickwit-oss/quickwit#5937): actions/checkout v4.2.2 actions-rs/toolchain v1.0.7 Swatinem/rust-cache v2.7.5 taiki-e/install-action nextest / cargo-llvm-cov actions-rs/clippy-check v1.0.7 codecov/codecov-action v3.1.6 - Add explicit least-privilege `permissions` blocks at workflow and job level (addresses excessive GITHUB_TOKEN permissions, analogous to quickwit-oss/quickwit#5945): default: contents: read check job: also grants checks: write (required by clippy-check) https://claude.ai/code/session_01VD7Bo8upj3cQwWDf9ni2Ln --- .github/workflows/coverage.yml | 15 +++++++++++---- .github/workflows/long_running.yml | 10 ++++++++-- .github/workflows/test.yml | 28 +++++++++++++++++++--------- 3 files changed, 38 insertions(+), 15 deletions(-) diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 95167ba41..7da4893e0 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -4,6 +4,9 @@ on: push: branches: [main] +permissions: + contents: read + # Ensures that we cancel running jobs for the same PR / same workflow. concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} @@ -12,16 +15,20 @@ concurrency: jobs: coverage: runs-on: ubuntu-latest + + permissions: + contents: read + steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Install Rust run: rustup toolchain install nightly-2025-12-01 --profile minimal --component llvm-tools-preview - - uses: Swatinem/rust-cache@v2 - - uses: taiki-e/install-action@cargo-llvm-cov + - uses: Swatinem/rust-cache@82a92a6e8fbeee089604da2575dc567ae9ddeaab # v2.7.5 + - uses: taiki-e/install-action@af00f4b4a828581905c69e668cd067c8dad0578a # cargo-llvm-cov - name: Generate code coverage run: cargo +nightly-2025-12-01 llvm-cov --all-features --workspace --doctests --lcov --output-path lcov.info - name: Upload coverage to Codecov - uses: codecov/codecov-action@v3 + uses: codecov/codecov-action@ab904c41d6ece82784817410c45d8b8c02684457 # v3.1.6 continue-on-error: true with: token: ${{ secrets.CODECOV_TOKEN }} # not required for public repos diff --git a/.github/workflows/long_running.yml b/.github/workflows/long_running.yml index 525aae058..22841e6de 100644 --- a/.github/workflows/long_running.yml +++ b/.github/workflows/long_running.yml @@ -8,6 +8,9 @@ env: CARGO_TERM_COLOR: always NUM_FUNCTIONAL_TEST_ITERATIONS: 20000 +permissions: + contents: read + # Ensures that we cancel running jobs for the same PR / same workflow. concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} @@ -18,10 +21,13 @@ jobs: runs-on: ubuntu-latest + permissions: + contents: read + steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Install stable - uses: actions-rs/toolchain@v1 + uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7 with: toolchain: stable profile: minimal diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 3a6ba2df9..793522d18 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -9,6 +9,9 @@ on: env: CARGO_TERM_COLOR: always +permissions: + contents: read + # Ensures that we cancel running jobs for the same PR / same workflow. concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} @@ -19,23 +22,27 @@ jobs: runs-on: ubuntu-latest + permissions: + contents: read + checks: write + steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Install nightly - uses: actions-rs/toolchain@v1 + uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7 with: toolchain: nightly profile: minimal components: rustfmt - name: Install stable - uses: actions-rs/toolchain@v1 + uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7 with: toolchain: stable profile: minimal components: clippy - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@82a92a6e8fbeee089604da2575dc567ae9ddeaab # v2.7.5 - name: Check Formatting run: cargo +nightly fmt --all -- --check @@ -47,7 +54,7 @@ jobs: - name: Check Bench Compilation run: cargo +nightly bench --no-run --profile=dev --all-features - - uses: actions-rs/clippy-check@v1 + - uses: actions-rs/clippy-check@b5b5f21f4797c02da247df37026fcd0a5024aa4d # v1.0.7 with: toolchain: stable token: ${{ secrets.GITHUB_TOKEN }} @@ -57,6 +64,9 @@ jobs: runs-on: ubuntu-latest + permissions: + contents: read + strategy: matrix: features: @@ -67,17 +77,17 @@ jobs: name: test-${{ matrix.features.label}} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Install stable - uses: actions-rs/toolchain@v1 + uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7 with: toolchain: stable profile: minimal override: true - - uses: taiki-e/install-action@nextest - - uses: Swatinem/rust-cache@v2 + - uses: taiki-e/install-action@ed90ac8c92bcd626a952a160afa50dfe66ca557c # nextest + - uses: Swatinem/rust-cache@82a92a6e8fbeee089604da2575dc567ae9ddeaab # v2.7.5 - name: Run tests run: | From 3a6a3de8d7949cd24c0a0d78397506d81157adf9 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 16 Apr 2026 06:49:47 +0000 Subject: [PATCH 2/2] ci: update pinned Action SHAs to current latest versions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous commit pinned actions to commit SHAs but used stale version tags (v4.2.2, v2.7.5, old nextest/cargo-llvm-cov refs). Update to the actual current HEAD of each pinned tag: actions/checkout v4.2.2 → v4.3.1 (34e114876b0b...) Swatinem/rust-cache v2.7.5 → v2.9.1 (c19371144df3...) taiki-e/install-action nextest (56cc9adf3a3e...) taiki-e/install-action cargo-llvm-cov (e4b3a0453201...) actions-rs/toolchain, actions-rs/clippy-check, and codecov/codecov-action SHAs were already correct. https://claude.ai/code/session_01VD7Bo8upj3cQwWDf9ni2Ln --- .github/workflows/coverage.yml | 6 +++--- .github/workflows/long_running.yml | 2 +- .github/workflows/test.yml | 10 +++++----- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 7da4893e0..6638e8b68 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -20,11 +20,11 @@ jobs: contents: read steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Install Rust run: rustup toolchain install nightly-2025-12-01 --profile minimal --component llvm-tools-preview - - uses: Swatinem/rust-cache@82a92a6e8fbeee089604da2575dc567ae9ddeaab # v2.7.5 - - uses: taiki-e/install-action@af00f4b4a828581905c69e668cd067c8dad0578a # cargo-llvm-cov + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 + - uses: taiki-e/install-action@e4b3a0453201addddc06d3a72db90326aad87084 # cargo-llvm-cov - name: Generate code coverage run: cargo +nightly-2025-12-01 llvm-cov --all-features --workspace --doctests --lcov --output-path lcov.info - name: Upload coverage to Codecov diff --git a/.github/workflows/long_running.yml b/.github/workflows/long_running.yml index 22841e6de..e0bc18b52 100644 --- a/.github/workflows/long_running.yml +++ b/.github/workflows/long_running.yml @@ -25,7 +25,7 @@ jobs: contents: read steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Install stable uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7 with: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 793522d18..1e0f1fab7 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -27,7 +27,7 @@ jobs: checks: write steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Install nightly uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7 @@ -42,7 +42,7 @@ jobs: profile: minimal components: clippy - - uses: Swatinem/rust-cache@82a92a6e8fbeee089604da2575dc567ae9ddeaab # v2.7.5 + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 - name: Check Formatting run: cargo +nightly fmt --all -- --check @@ -77,7 +77,7 @@ jobs: name: test-${{ matrix.features.label}} steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Install stable uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7 @@ -86,8 +86,8 @@ jobs: profile: minimal override: true - - uses: taiki-e/install-action@ed90ac8c92bcd626a952a160afa50dfe66ca557c # nextest - - uses: Swatinem/rust-cache@82a92a6e8fbeee089604da2575dc567ae9ddeaab # v2.7.5 + - uses: taiki-e/install-action@56cc9adf3a3e2c23eafb56e8acaf9d0373cb845a # nextest + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 - name: Run tests run: |