From 4b3d5cedbe444612d5c0b6727fc2b77af79f5515 Mon Sep 17 00:00:00 2001 From: Bob Callaway Date: Fri, 17 Jul 2026 21:12:13 +0000 Subject: [PATCH] set permissions, pin actions refs and omit credentials on checkout Signed-off-by: Bob Callaway --- .github/workflows/clang-format.yaml | 9 +++++++-- .github/workflows/main.yml | 7 ++++++- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/.github/workflows/clang-format.yaml b/.github/workflows/clang-format.yaml index 091574f..5c6fc40 100644 --- a/.github/workflows/clang-format.yaml +++ b/.github/workflows/clang-format.yaml @@ -1,13 +1,18 @@ name: Check clang-format on: [push, pull_request] +permissions: + contents: read jobs: formatting-check: name: Formatting Check runs-on: 'ubuntu-24.04' + steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Run clang-format style check for C/C++/Protobuf programs. - uses: jidicula/clang-format-action@v4.17.0 + uses: jidicula/clang-format-action@654a770daa28443dd111d133e4083e21c1075674 # v4.18.0 with: clang-format-version: '21' fallback-style: 'Google' # optional diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index aa8d896..404ce7c 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -13,6 +13,9 @@ on: # Allows you to run this workflow manually from the Actions tab workflow_dispatch: +permissions: + contents: read + # A workflow run is made up of one or more jobs that can run sequentially or in parallel jobs: # This workflow contains a single job called "build" @@ -23,7 +26,9 @@ jobs: # Steps represent a sequence of tasks that will be executed as part of the job steps: # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it - - uses: actions/checkout@v6 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Install extra packages run: |