Skip to content

Improve GitHub Action workflows#358

Merged
frenck merged 1 commit intomainfrom
frenck-2026-0006
Jan 27, 2026
Merged

Improve GitHub Action workflows#358
frenck merged 1 commit intomainfrom
frenck-2026-0006

Conversation

@frenck
Copy link
Copy Markdown
Member

@frenck frenck commented Jan 27, 2026 •
edited by coderabbitai bot
Loading

Proposed Changes

Improve the existing worksflows

Summary by CodeRabbit

  • New Features

    • Added automated dependency review to detect security vulnerabilities in pull requests.
    • Added automated linting checks to improve code quality standards.

  • Chores

    • Enhanced security by configuring explicit permissions for automated workflows.
    • Pinned GitHub Actions to specific versions for improved reproducibility and stability.

✏️ Tip: You can customize this high-level summary in your review settings.

@frenck frenck added the ci Work that improves the continue integration. label Jan 27, 2026
@github-advanced-security
Copy link
Copy Markdown

github-advanced-security bot commented Jan 27, 2026

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Jan 27, 2026 •
edited
Loading

Walkthrough

This pull request hardens GitHub Actions security by pinning workflow and action references to specific commit hashes instead of branch references, introducing explicit least-privilege permissions blocks across workflows, and adding new dependency review and linting workflows following the same security practices.

Changes

Cohort / File(s) Changes
GitHub Actions Security Hardening
.github/workflows/ci.yaml, deploy.yaml, labels.yaml, lock.yaml, pr-labels.yaml, release-drafter.yaml, stale.yaml		 Pin action/workflow references to specific commit hash 19abc57e997a6e14cb4ba35968a442e1fadbfbc2 and add explicit least-privilege permissions blocks granting only required access levels
New Workflows
.github/workflows/dependency-review.yaml, linting.yaml		 Introduce new GitHub Actions workflows: dependency-review runs dependency-review-action with contents read permission; linting runs zizmor-action to check workflow security with specified permissions on push, pull_request, and workflow_dispatch events
Configuration Updates
.github/renovate.json		 Extend Renovate configuration with helpers:pinGitHubActionDigests to automatically pin GitHub Action digests

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Poem

🐰 Hoppy day! Security's on the way,
With commits pinned and permissions held tight,
New workflows dance in the GitHub light,
Our actions are locked, our code shines bright—
Bounce bounce bounce! All is secure tonight! 🔐

🚥 Pre-merge checks | ✅ 2 | ❌ 1
❌ Failed checks (1 inconclusive)
Check name Status Explanation Resolution
Title check ❓ Inconclusive The title 'Improve GitHub Action workflows' is vague and generic, using non-descriptive language that doesn't convey specific information about what was actually changed. Consider a more specific title that highlights the main change, such as 'Pin GitHub Actions to commit hashes and add workflow permissions' or 'Add security-focused workflow improvements with pinned action digests'.
✅ Passed checks (2 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@frenck frenck merged commit 7c95df4 into main Jan 27, 2026
23 checks passed
@frenck frenck deleted the frenck-2026-0006 branch January 27, 2026 19:33
@coderabbitai coderabbitai bot mentioned this pull request Jan 28, 2026
Merged
@github-actions github-actions bot locked and limited conversation to collaborators Jan 29, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

ci Work that improves the continue integration.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@frenck @github-advanced-security