Skip to content

ci: harden validation workflow - #2

Merged
TonkaToyXL merged 0 commit into
mainfrom
agent/ci-security-hardening
Jul 17, 2026
Merged

TonkaToyXL merged 0 commit into
mainfrom
agent/ci-security-hardening

Conversation

@TonkaToyXL

Copy link
Copy Markdown
Owner

Summary

  • pin CI actions by commit SHA and disable persisted checkout credentials
  • apply least-privilege permissions, concurrency cancellation, and a job timeout
  • pin pytest and run the existing test suite in CI

Verification

  • Python compile check
  • shell syntax checks
  • python -m pytest tests/ -q (5 passed)
  • workflow YAML parse
  • git diff --check

@TonkaToyXL
TonkaToyXL marked this pull request as ready for review July 17, 2026 21:59
@TonkaToyXL
TonkaToyXL merged this pull request into main Jul 17, 2026
4 checks passed
@TonkaToyXL
TonkaToyXL deleted the agent/ci-security-hardening branch July 17, 2026 21:59
TonkaToyXL added a commit that referenced this pull request Jul 19, 2026
Run CI with least-privilege permissions, pinned action commits, no persisted checkout credentials, and a timeout. Install the exact test dependency and execute the existing test suite in CI.

Co-authored-by: Codex <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant