Skip to content

- Harden GitHub Actions workflows with explicit minimum permissions and SHA-pinned actions#87

Merged
mtracz merged 1 commit intomainfrom
copilot/validate-github-actions-workflows
Mar 26, 2026
Merged

- Harden GitHub Actions workflows with explicit minimum permissions and SHA-pinned actions#87
mtracz merged 1 commit intomainfrom
copilot/validate-github-actions-workflows

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Mar 25, 2026

Both workflows lacked explicit permissions blocks (falling back to over-permissive defaults) and shivammathur/setup-php was pinned to a mutable version tag instead of a commit SHA.

Changes

  • test-and-lint-php.yml

    • Added permissions: contents: read at workflow level
    • Pinned shivammathur/setup-php from @2.30.0@a4e22b60bbb9c1021113f2860347b0759f66fe5d # v2.30.0
  • check-pr-title.yml

    • Added permissions: pull-requests: read at workflow level
permissions:
  contents: read   # test-and-lint-php.yml — checkout only
permissions:
  pull-requests: read   # check-pr-title.yml — PR metadata access only

@mtracz mtracz requested a review from a team March 25, 2026 21:42
@mtracz mtracz marked this pull request as ready for review March 25, 2026 21:42
@mtracz mtracz merged commit ecf2037 into main Mar 26, 2026
2 checks passed
@mtracz mtracz deleted the copilot/validate-github-actions-workflows branch March 26, 2026 10:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants