stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Pin release pipeline actions and enforce least-privilege permissions #1378

New Issue
Closed
opened 2026-08-25 03:52:29 +00:00 by timmy · 0 comments
timmy commented 2026-08-25 03:52:29 +00:00
Owner
Copy Link

Evidence

The release workflow currently resolves checkout, Python setup, upload, and download actions through mutable version tags. The release job has write access, so upstream tag movement can change the code that tests, transports, and publishes artifacts. Historical issue titles, current PRs, and recent commits contain no shipped equivalent; an earlier partial pinning commit was reverted and lacked a regression policy.

User impact

Release candidates become reproducible and resistant to upstream tag takeover. Routine test jobs cannot mutate repository contents.

Acceptance tests

  • Every external uses: reference is a full 40-character audited commit SHA with a readable version comment.
  • A workflow policy test rejects mutable tag or branch references.
  • Workflow defaults to contents: read; only the release-candidate job receives contents: write.
  • Existing artifact compatibility and release checksum gates remain green on the Gitea runner.
## Evidence The release workflow currently resolves checkout, Python setup, upload, and download actions through mutable version tags. The release job has write access, so upstream tag movement can change the code that tests, transports, and publishes artifacts. Historical issue titles, current PRs, and recent commits contain no shipped equivalent; an earlier partial pinning commit was reverted and lacked a regression policy. ## User impact Release candidates become reproducible and resistant to upstream tag takeover. Routine test jobs cannot mutate repository contents. ## Acceptance tests - Every external `uses:` reference is a full 40-character audited commit SHA with a readable version comment. - A workflow policy test rejects mutable tag or branch references. - Workflow defaults to `contents: read`; only the release-candidate job receives `contents: write`. - Existing artifact compatibility and release checksum gates remain green on the Gitea runner.
timmy self-assigned this 2026-08-25 03:52:29 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
timmy
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#1378
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?