CI: Harden GHA configuration #166
Conversation
cheatsheets.tex
Outdated
| @@ -264,7 +264,7 @@ | |||
| \begin{multicols*}{5} | |||
| \begin{overpic}[width=\columnwidth,tics=6,trim=12 6 18 6, clip]{logo2.png} | |||
| \put (16.5,1.5) {\scriptsize\RobotoCon \textcolor[HTML]{11557c}{Cheat sheet}} | |||
| \put (80,1.5) {\tiny\Roboto \textcolor[HTML]{11557c}{Version 3.5.0}} | |||
There was a problem hiding this comment.
We could algo generate a matplotlib-version.tex with a \newcommand\matplotlibversion{3.5.1} (proper version to be generated) and include this file in every tex files.
|
this picked up more changes than I expected an is not started from main, re-basing! |
Reduces risk of arbitrary code is run by attacker.
Reduces risk of arbitrary code is run by attacker.
This eliminates the possibility of a tag being changed under us.
| on: [push, pull_request] | ||
|
|
||
| jobs: | ||
| pre-commit: | ||
| permissions: | ||
| contents: read | ||
|
|
||
| runs-on: ubuntu-20.04 | ||
| steps: | ||
| - uses: actions/checkout@v4 |
.github/workflows/main.yaml
Outdated
| on: [push, pull_request] | ||
|
|
||
| jobs: | ||
| pre-commit: | ||
| permissions: | ||
| contents: read | ||
|
|
||
| runs-on: ubuntu-20.04 |
There was a problem hiding this comment.
Does dependabot not suggest updating this? Isn't it deprecated?
There was a problem hiding this comment.
I don't think dependabot suggest updating images?
There was a problem hiding this comment.
Well, it's probably why the CI isn't running, then.
| - uses: actions/checkout@v4 | ||
| with: | ||
| persist-credentials: false | ||
| - uses: actions/setup-python@v5 |
There was a problem hiding this comment.
none of the wave of PRs pin the actions/XYZ to a sha.
.github/workflows/main.yaml
Outdated
| - name: Output artifacts URL | ||
| run: | | ||
| echo 'Artifact URL:' \ | ||
| '${{ steps.diffs-artifact-upload.outputs.artifact-url }}' \ | ||
| '${STEPS_DIFFS_ARTIFACT_UPLOAD_OUTPUTS_ARTIFACT_URL}' \ | ||
| >> $GITHUB_STEP_SUMMARY | ||
| env: | ||
| STEPS_DIFFS_ARTIFACT_UPLOAD_OUTPUTS_ARTIFACT_URL: ${{ steps.diffs-artifact-upload.outputs.artifact-url }} |
There was a problem hiding this comment.
I don't think we need this step at all any more; the build summary and artifacts are both displayed on the Summary page, so this is redundant.
Co-authored-by: Elliott Sales de Andrade <quantum.analyst@gmail.com>
Apply recommended hardening steps including: