Skip to content

[skip ci] GitHub Actions の設定見直し#20

Merged
saitota merged 1 commit into
mainfrom
fix-zizmor-check-pull-request
May 8, 2026
Merged

[skip ci] GitHub Actions の設定見直し#20
saitota merged 1 commit into
mainfrom
fix-zizmor-check-pull-request

Conversation

@saitota

@saitota saitota commented May 8, 2026

Copy link
Copy Markdown
Contributor

概要

  • Pull Request チェック用 workflow のセキュリティ設定を見直し
  • pinact を使って GitHub Actions の参照を固定
  • workflow token の権限と checkout 時の認証情報の扱いを制限

修正理由

Public repositoryなので GitHub Actions 経由の supply-chain risk や token exposure risk をできるだけ小さくした

zizmor で 以下の指摘が出ていたのでそれぞれ対応しました。

  • unpinned action references
  • broad default permissions
  • checkout credential persistence

検証

  • pinact run --check .github/workflows/check-pull-request.yml
  • zizmor .github/workflows/check-pull-request.yml

@saitota saitota self-assigned this May 8, 2026
@saitota saitota requested a review from sogaoh May 8, 2026 05:27
@saitota saitota changed the title GitHub Actions の zizmor 指摘を修正 GitHub Actions の設定見直し May 8, 2026
@saitota saitota changed the title GitHub Actions の設定見直し [skip ci] GitHub Actions の設定見直し May 8, 2026
@aws-amplify-ap-northeast-1

Copy link
Copy Markdown

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-20.d3meh43nj9rhk3.amplifyapp.com

@sogaoh sogaoh left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
あざますー

@saitota saitota merged commit dc303c0 into main May 8, 2026
2 checks passed
@saitota saitota deleted the fix-zizmor-check-pull-request branch May 8, 2026 10:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants