Pin release pipeline actions and enforce least-privilege permissions #1379

2026-08-25T03:57:40Z

timmy commented

2026-08-25 03:57:40 +00:00

Pins every external release-pipeline action to a verified upstream commit while retaining Gitea-compatible artifact v3 actions. Workflow-wide repository access is read-only, with write access scoped to release publication.

Tests: python3 -m pytest tests/ -q (2617 passed, 21 skipped).

Closes #1378 Pins every external release-pipeline action to a verified upstream commit while retaining Gitea-compatible artifact v3 actions. Workflow-wide repository access is read-only, with write access scoped to release publication. Tests: `python3 -m pytest tests/ -q` (2617 passed, 21 skipped).

timmy added 1 commit 2026-08-25 03:57:40 +00:00

ci: pin release pipeline actions (Closes #1378 )

CI / lint (pull_request) Successful in 3m11s

Details

CI / build-release (pull_request) Successful in 24s

Details

CI / browser-journey (pull_request) Successful in 5m31s

Details

CI / release-candidate (pull_request) Has been skipped

Details

22fe5dd1d8

rockachopa merged commit fc7a83fbd7 into main

2026-08-25 04:21:42 +00:00

rockachopa referenced this issue from a commit

2026-08-25 04:21:42 +00:00

Merge pull request 'Pin release pipeline actions and enforce least-privilege permissions' (#1379) from timmy/1378-pin-release-actions into main

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#1379