🛡️ Sentinel: Pin GitHub Actions to SHAs and restrict workflow permissions - #125
🛡️ Sentinel: Pin GitHub Actions to SHAs and restrict workflow permissions#125google-labs-jules[bot] wants to merge 2 commits into
Conversation
- Hardens GitHub Actions workflow security by pinning 'actions/checkout' and 'jdx/mise-action' to secure, immutable full-length commit SHAs. - Resolves the use of the non-existent and unstable '@v7' tag. - Configures explicit 'permissions: contents: read' for least-privilege security in check.yml. - Resolves name shadowing in 'tests/test_app.py' to clean up pyright type-checking errors. - Records key learnings in Sentinel's security journal.
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
- Hardens GitHub Actions workflow security by pinning 'actions/checkout' and 'jdx/mise-action' to secure, immutable full-length commit SHAs. - Resolves the use of the non-existent and unstable '@v7' tag. - Configures explicit 'permissions: contents: read' for least-privilege security in check.yml. - Resolves name shadowing in 'tests/test_app.py' to clean up pyright type-checking errors. - Records key learnings in Sentinel's security journal.
|
This pull request introduces key security hardening improvements to the repository's GitHub Actions workflows and clean up type checking errors:
Workflow Hardening:
actions/checkoutandjdx/mise-action) to secure, immutable full-length commit SHAs instead of mutable tags, satisfying a major security best practice (OpenSSF/Scorecard).@v7tag foractions/checkoutwhich compromised pipeline stability.GITHUB_TOKENpermissions incheck.ymlto the minimal necessary (contents: read) to follow the principle of least privilege.Clean up Type Checker Errors:
tests/test_app.pyname-main block to useimport pytestand callpytest.main()directly, avoiding name shadowing ofmainimported fromproject.app. This results in clean pyright check with zero errors.Security Journaling:
.jules/sentinel.md.PR created automatically by Jules for task 16490658253199903106 started by @amrabed