3 people 960caf86aa Pin release-workflow actions to commit SHAs + least-privilege token (#862) ...

Every `uses:` in build-release.yml was a mutable tag; the `release` job has
`contents: write` and publishes the binaries users install, so a compromised
action could tamper the release. Action tag-hijacking keeps recurring
(aquasecurity/trivy-action, 75 tags, Mar 2026 TeamPCP; tj-actions, 2025;
codfish/semantic-release-action, Jun 2026) and SHA-pinned workflows were immune
each time. Pin all six actions to the commit each @major resolves to today
(concrete version in a trailing comment; setup-uv's annotated tag dereferenced
to its commit, not the tag object, so Dependabot tracks it). Also add a
top-level `permissions: contents: read` (the release job keeps its explicit
write) and `persist-credentials: false` on the build checkout.

actionlint passes. Pairs with #860 (Dependabot github-actions keeps the pins
current).

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-23 15:22:28 -04:00

..

build-release.yml

Pin release-workflow actions to commit SHAs + least-privilege token (#862)

2026-07-23 15:22:28 -04:00