From 19aa8ee7e06a0b3df8abf18ccb52260fab4df888 Mon Sep 17 00:00:00 2001 From: kalenkevich Date: Tue, 11 Aug 2026 19:25:39 -0700 Subject: [PATCH] ci: pin validation.yaml actions so zizmor stops failing every PR MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit validation.yaml still references actions/checkout, setup-node and setup-python by tag. zizmor treats unpinned-uses as a mandatory check, so the zizmor-output gate fails on every pull request that does not itself touch this file — the finding is in the base branch, not in the PR. Pin all three to the commit hash for the tag they already used, add the read-only `contents` permission for the job, and turn off credential persistence on checkout. The same hunk is currently carried by #634; splitting it out so it can land on its own and unblock the other open PRs. --- .github/workflows/validation.yaml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/validation.yaml b/.github/workflows/validation.yaml index 7bb00098e8..432bfb0d7f 100644 --- a/.github/workflows/validation.yaml +++ b/.github/workflows/validation.yaml @@ -12,19 +12,23 @@ env: jobs: run-tests: runs-on: ${{ matrix.os }} + permissions: + contents: read strategy: matrix: os: [ubuntu-latest, windows-latest, macos-latest] steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Use Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 - name: Setup Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: '3.11'