Skip to content

ci: harden the workflows (deploy-key step, action pinning, unused secrets, permissions) #1968

Closed
Closed
ci: harden the workflows (deploy-key step, action pinning, unused secrets, permissions)#1968
Labels
ciPull requests that change CI or workflow configuration (ci: subject prefix)
Milestone
PyPCAPKit v1.5

Description

@JarryShaw
JarryShaw
opened on Oct 20, 2026

These hardening items came out of the workflow review behind the companion workflow issue.

  • tj-actions/verify-changed-files@v17 runs after the deploy key is loaded (cron-vendor.yml:300, cron-conda.yml:195). It comes from the publisher whose tj-actions/changed-files was compromised in March 2025. git status --porcelain does the same check.
  • No action is pinned to a commit SHA, and Dependabot covers pip only (.github/dependabot.yml). Adding the github-actions ecosystem breaks the tests that hard-code action versions (ncipollo@v1.21.0, create-github-app-token@v3, verify-changed-files@v17), so those tests move with the change.
  • PYPI_API_TOKEN and TEST_PYPI_API_TOKEN are not used by any workflow. ANACONDA_TOKEN, the PAT and the deploy key are repository-wide. The anaconda and conda-tag environments hold no secrets, so the separation described at create-release.yml:34-76 does not hold.
  • create-release.yml and CodeQL declare no top-level permissions. deploy-pages.yml grants contents: write to pull-request doc builds.

The first item is a code change. The secrets and environments are repository settings, and only you can change them.

Activity

  1. JarryShaw
    added
    ciPull requests that change CI or workflow configuration (ci: subject prefix)
    needs: decisionWaiting on the maintainer to decide — not blocked by other work
    on Oct 20, 2026

  2. JarryShaw commented on Oct 20, 2026

    @JarryShaw
    JarryShaw
    on Oct 20, 2026
    OwnerAuthor

    Anything to make decision?

  3. JarryShaw commented on Oct 20, 2026

    @JarryShaw
    JarryShaw
    on Oct 20, 2026
    OwnerAuthor

    Four decisions; my recommendation is in bold.

    1. Replace tj-actions/verify-changed-files with a git status --porcelain step. Recommended yes. It is a code change and I can do it now.
    2. Pin every action to a commit SHA, with a version comment, and add the github-actions ecosystem to Dependabot. Recommended yes. The tests that hard-code action tags (ncipollo@v1.21.0, create-github-app-token@v3, verify-changed-files@v17) move with it.
    3. The unused PYPI_API_TOKEN and TEST_PYPI_API_TOKEN. Recommended: delete them. Only you can, in Settings → Secrets.
    4. Secrets scoped to environments. ANACONDA_TOKEN, the PAT and the deploy key are repository-wide, so the anaconda / conda-tag environments guard nothing. Recommended: move each into the environment that needs it, so its approval rule actually applies. That is also a settings change, and the workflow side follows it.

    The rest needs no decision, and I will do it with 1–2:

    • top-level permissions in create-release.yml and CodeQL;
    • contents: read for pull-request builds in deploy-pages.yml.
  4. JarryShaw
    added this to PyPCAPKiton Oct 20, 2026
  5. JarryShaw
    moved this to Needs decision in PyPCAPKiton Oct 20, 2026

  6. JarryShaw commented on Oct 20, 2026

    @JarryShaw
    JarryShaw
    on Oct 20, 2026
    OwnerAuthor

    Take all your recommendations

  7. JarryShaw commented on Oct 20, 2026

    @JarryShaw
    JarryShaw
    on Oct 20, 2026
    OwnerAuthor

    Taking all four. It splits into three pieces of work:

    • PR now: replace verify-changed-files with a git status --porcelain step in cron-vendor.yml and cron-conda.yml. Add top-level permissions to create-release.yml and CodeQL, and contents: read for pull-request builds in deploy-pages.yml. ci: categorise the tests into tiers and run each tier where it belongs #1958 phase 1 does not touch these files.
    • PR after ci: categorise the tests into tiers and run each tier where it belongs #1958 phase 1 lands: SHA-pin every action with a version comment, add the github-actions ecosystem to .github/dependabot.yml, and move the tag-pinning tests with them. This touches every workflow, so it waits.
    • Yours, in Settings: delete PYPI_API_TOKEN and TEST_PYPI_API_TOKEN, and move ANACONDA_TOKEN, the PAT and the deploy key into the environments whose jobs use them. Once they have moved, a follow-up checks that every job that reads one declares its environment:.
  8. JarryShaw
    added
    wipWork in flight - a covering PR is open or an agent is actively on it
    and removed
    needs: decisionWaiting on the maintainer to decide — not blocked by other work
    on Oct 20, 2026
  9. JarryShaw
    moved this from Needs decision to WIP in PyPCAPKiton Oct 20, 2026
  10. JarryShaw
    added 2 commits that reference this issue on Oct 20, 2026

    ci(pages): never publish a build that main has moved past (#1968)

    7a4a2cf

    ci: drop the third-party step after the deploy key and declare workfl…

    c68a5ac

  11. JarryShaw commented on Oct 20, 2026

    @JarryShaw
    JarryShaw
    on Oct 20, 2026
    OwnerAuthor

    Blocked until both #1972 and #1973 merge. SHA-pinning the actions and adding github-actions to Dependabot touches every workflow those two PRs edit.

  12. JarryShaw
    removed
    wipWork in flight - a covering PR is open or an agent is actively on it
    on Oct 20, 2026

  13. 21 remaining items

  14. JarryShaw
    added
    wipWork in flight - a covering PR is open or an agent is actively on it
    on Oct 20, 2026
  15. JarryShaw
    moved this from Needs decision to WIP in PyPCAPKiton Oct 20, 2026
  16. JarryShaw
    added 3 commits that reference this issue on Oct 20, 2026

    ci(dependabot): make the readme static and skip conda/requirements.txt (

    752cbdd

    ci: name the secrets' environments on the cron jobs (#1968) (#1993)

    11c26b8

    ci: make the readme static so Dependabot can build the editable insta…

    2f806eb

  17. JarryShaw commented on Oct 20, 2026

    @JarryShaw
    JarryShaw
    on Oct 20, 2026
    OwnerAuthor

    #1993 has merged, so the cron jobs now name anaconda and conda-tag. You can move the secrets: add ANACONDA_TOKEN to anaconda, and PYPCAPKIT and PYPCAPKIT_ACTIONS_DEPLOY_KEY to conda-tag, then delete the repository copies. Nothing else in this issue is left on the code side.

  18. JarryShaw
    added
    needs: decisionWaiting on the maintainer to decide — not blocked by other work
    and removed
    wipWork in flight - a covering PR is open or an agent is actively on it
    on Oct 20, 2026
  19. JarryShaw
    moved this from WIP to Needs decision in PyPCAPKiton Oct 20, 2026

  20. JarryShaw commented on Oct 21, 2026

    @JarryShaw
    JarryShaw
    on Oct 21, 2026
    OwnerAuthor

    i'll find time for this update. we can close this for now so that it wont block the workflow.

  21. JarryShaw commented on Oct 21, 2026

    @JarryShaw
    JarryShaw
    on Oct 21, 2026
    OwnerAuthor

    Closing, as you suggested. The code side is done (#1970, #1981, #1993, #1994). What remains is moving ANACONDA_TOKEN into anaconda and PYPCAPKIT with PYPCAPKIT_ACTIONS_DEPLOY_KEY into conda-tag, whenever suits; the cron jobs already name both environments.

  22. JarryShaw
    removed
    needs: decisionWaiting on the maintainer to decide — not blocked by other work
    on Oct 21, 2026
  23. JarryShaw
    closed this as completedon Oct 21, 2026
  24. github-project-automation
    moved this from Needs decision to Done in PyPCAPKiton Oct 21, 2026
  25. JarryShaw
    added this to the PyPCAPKit v1.5 milestone on Oct 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    ciPull requests that change CI or workflow configuration (ci: subject prefix)

    Projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions