Skip to content

ci: give the registry job least privilege and pin its action to a commit #453

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Mearman merged 2 commits into from
Oct 22, 2026
+6 −1
Merged

ci: give the registry job least privilege and pin its action to a commit #453

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6d4a478
ci: give the registry job least privilege and pin its action to a commit
Mearman Oct 22, 2026
911bca9
ci: pin the registry action to the release that logs each retry's cause
Mearman Oct 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -220,6 +220,10 @@ jobs:
if: ${{ !cancelled() && needs.release.result != 'failure' && ((github.ref == 'refs/heads/main' && github.event_name == 'push') || github.event_name == 'workflow_dispatch') }}
needs: [release]
runs-on: ubuntu-latest
# The workflow-level permissions are broad enough for the release job (contents, issues and pull requests, all write). This job runs a third-party-shaped action with the OIDC token that publishes under this repository's registry namespace, so it gets only what the action's own README asks for: a read checkout and the OIDC token. A moved tag on that action then cannot write to this repository.
permissions:
contents: read
id-token: write
steps:
# A push to main publishes what the release job just committed, which is main's new tip and not the commit this run started from. The publisher is the pinned `ExaDev/mcp-registry-publish` action, never code from a release tag, so a backfill of an old version runs today's retry handling; a dispatch naming a `registry_ref` takes only that tag's server.json from it.
- uses: actions/checkout@v7
Expand All @@ -232,5 +236,6 @@ jobs:
run: |
git fetch --depth=1 origin "refs/tags/${REGISTRY_REF}"
git show FETCH_HEAD:server.json > server.json
- uses: ExaDev/mcp-registry-publish@v1
# Pinned to the commit of the release, not the moving major tag: GitHub's secure use guidance is a full-length SHA, since a tag can be moved, and this step holds the registry publishing identity. Dependabot's github-actions updates keep the pin current.
- uses: ExaDev/mcp-registry-publish@b8148f254d6788ac7fd817a0bd8d8f0abe4784d5 # v1.0.3

Loading