Conversation
…s to current Every job ran with the repository default of a read/write GITHUB_TOKEN. The token is now read-only by default; release-maven gets contents: write (release:prepare pushes the tag, action-gh-release publishes) and the Docker release jobs packages: write for GHCR. Third-party actions were referenced by moving major tags; they are pinned to the commits of their current releases, with dependabot keeping the pins current. All actions move to their latest majors: checkout v7, setup-java v6, cache v6, upload-artifact v7, action-gh-release v3 (Node 24 only, same inputs), docker/* to their latest 6.x/4.x/7.x.
vharseko
added
ci
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the 28 medium CodeQL alerts on the workflows:
actions/missing-workflow-permissions(7 jobs) andactions/unpinned-tag(21 uses).Token permissions
The repository's default
GITHUB_TOKENis read/write (default_workflow_permissions=write) and none ofbuild.yml,deploy.yml,release.ymlhad apermissionsblock, so every job — including the PR builds — ran with a token that can push to the repository. Now:permissionsbuild-maven,build-docker*localhost:5000contents: read(workflow level)deploy-mavencontents: read(workflow level)release-mavenmvn release:preparepushes the release commits and tag through the checkout token;action-gh-releasecreates the releasecontents: writerelease-docker*docker/login-actionto GHCR withGITHUB_TOKEN, image pushcontents: read,packages: writecodeql.ymlalready had its block. Only a real release exercisesrelease-maven'scontents: write— ifrelease:prepareneeds more than that, it will show on the first release; the change is one block to adjust.Pinned and current
Third-party actions were used by moving major tags (
docker/*@v4/v6/v7,softprops/action-gh-release@v2), so whoever can move a tag runs code in the release job next to the OSSRH, GPG and Docker Hub secrets. They are pinned to the commits of their current releases (# vX.Y.Znext to each), and all actions move to their latest majors:dc802804…v6.2.099012661…v4.4.0f87e5991…v4.4.1c3c9e263…v7.4.0dbcb8138…v4.6.0efb35369…v3.0.3 — 3.0 only moves the runtime to Node 24, inputs unchangedChecked the major-version notes:
actions/checkoutv7 refuses to check out fork PRs underworkflow_run/pull_request_target—deploy.ymlonly checks out the repository's own branches onpush, so it is unaffected;setup-javav6 switched the Zulu lookup to the Azul Metadata API and renamedjdkFile(not used here); the Node 24 runtimes need runner ≥ 2.327.1, which the GitHub-hosted runners have. First-partyactions/*stay on major tags (the rule does not flag them; dependabot updates them as well)..github/dependabot.yml(new) updates GitHub Actions weekly in one grouped PR, so the commit pins do not silently fall behind.deploy.ymlgets the license header it was missing.