mirror of
https://github.com/usestrix/strix.git
synced 2026-08-16 17:27:26 +02:00
960caf86aa
Every `uses:` in build-release.yml was a mutable tag; the `release` job has `contents: write` and publishes the binaries users install, so a compromised action could tamper the release. Action tag-hijacking keeps recurring (aquasecurity/trivy-action, 75 tags, Mar 2026 TeamPCP; tj-actions, 2025; codfish/semantic-release-action, Jun 2026) and SHA-pinned workflows were immune each time. Pin all six actions to the commit each @major resolves to today (concrete version in a trailing comment; setup-uv's annotated tag dereferenced to its commit, not the tag object, so Dependabot tracks it). Also add a top-level `permissions: contents: read` (the release job keeps its explicit write) and `persist-credentials: false` on the build checkout. actionlint passes. Pairs with #860 (Dependabot github-actions keeps the pins current). Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
