From c61ab3da1ea768c450595e5e71fe64a5e16c66cf Mon Sep 17 00:00:00 2001 From: Cody Bruno Date: Thu, 26 Mar 2026 11:16:32 -0400 Subject: [PATCH 1/2] Harden GitHub Actions: pin actions to SHAs and set explicit permissions --- .github/workflows/deploy.yml | 2 +- .github/workflows/trigger-steampipe-io.yml | 9 ++++++--- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 13b1243..3cdb8a8 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -20,7 +20,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Trigger search records update in steampipe.io - uses: peter-evans/repository-dispatch@v3 + uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3 with: token: ${{ secrets.G_PERSONAL_ACCESS_TOKEN }} repository: turbot/steampipe.io diff --git a/.github/workflows/trigger-steampipe-io.yml b/.github/workflows/trigger-steampipe-io.yml index a2bcb3d..372b17f 100644 --- a/.github/workflows/trigger-steampipe-io.yml +++ b/.github/workflows/trigger-steampipe-io.yml @@ -10,13 +10,16 @@ on: pull_request: types: [opened] +permissions: + contents: read + jobs: update: runs-on: ubuntu-latest if: ${{ github.event_name == 'push' }} steps: - name: Repository Dispatch - uses: peter-evans/repository-dispatch@v3 + uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3 with: token: ${{ secrets.G_PERSONAL_ACCESS_TOKEN }} repository: turbot/steampipe.io @@ -32,7 +35,7 @@ jobs: - name: Get the deployment details id: get_deployment_details if: ${{ github.event_name == 'pull_request' && github.event.action == 'opened' }} - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6 with: script: | const branchName = 'docs/${{ github.event.pull_request.head.ref }}'; @@ -54,7 +57,7 @@ jobs: } - name: Add comment with preview link - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7 if: ${{ steps.get_deployment_details.outputs.foundDeployment == 'true' }} with: script: | From b25d2d143c235cf16665a6828fe898cb83b8f14c Mon Sep 17 00:00:00 2001 From: Cody Bruno Date: Thu, 26 Mar 2026 13:56:06 -0400 Subject: [PATCH 2/2] Fix comment-link job permissions: add pull-requests: write for PR commenting --- .github/workflows/trigger-steampipe-io.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/trigger-steampipe-io.yml b/.github/workflows/trigger-steampipe-io.yml index 372b17f..6a1c71d 100644 --- a/.github/workflows/trigger-steampipe-io.yml +++ b/.github/workflows/trigger-steampipe-io.yml @@ -28,6 +28,8 @@ jobs: comment-link: + permissions: + pull-requests: write runs-on: ubuntu-latest timeout-minutes: 5 if: ${{ github.event_name == 'pull_request' && github.event.action == 'opened' }}