Skip to content

Harden GitHub Actions workflows#731

Merged
Kobzol merged 2 commits into
rust-lang:mainfrom
yalagadapavankumar:fix-issues
Apr 15, 2026
Merged

Harden GitHub Actions workflows#731
Kobzol merged 2 commits into
rust-lang:mainfrom
yalagadapavankumar:fix-issues

Conversation

@yalagadapavankumar

@yalagadapavankumar yalagadapavankumar commented Apr 12, 2026

Copy link
Copy Markdown
Contributor

Improved security and reliability of Github Actions and workflow
Changes:

  • Restricted permissions to minimum required
  • Disabled credentials persistence

Before: 31 findings: 1 informational, 10 low, 8 medium, 12 high
After: some of them fixed,info[anonymous-definition] and help[concurrency-limits] are ignored.

@Kobzol Kobzol left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you, left some comments.

View changes since this review

Comment thread .github/workflows/audit.yml Outdated
Comment thread .github/workflows/audit.yml Outdated
Comment thread .github/workflows/deploy-production.yml Outdated
Comment thread .github/workflows/deploy-production.yml
Comment thread .github/workflows/test.yml Outdated
Comment thread .github/workflows/zizmor.yml Outdated
@rustbot

This comment has been minimized.

@rustbot

This comment has been minimized.

@yalagadapavankumar

Copy link
Copy Markdown
Contributor Author

Hi @Kobzol , i fixed all findings and ignored as you suggested.
if this PR merge then all findings(errors) will be passed in this PR #732

kindly review and give any suggestions.

@Kobzol

Kobzol commented Apr 14, 2026

Copy link
Copy Markdown
Member

Could you remove the SHA changes from this PR? They were already done by renovatebot. Thanks!

@rustbot

rustbot commented Apr 14, 2026

Copy link
Copy Markdown
Collaborator

This PR was rebased onto a different main commit. Here's a range-diff highlighting what actually changed.

Rebasing is a normal part of keeping PRs up to date, so no action is needed—this note is just to help reviewers.

@yalagadapavankumar

Copy link
Copy Markdown
Contributor Author

Could you remove the SHA changes from this PR? They were already done by renovatebot. Thanks!

I've removed the SHA changes from the PR and kept the updates from Renovate. Let me know if anything else needed.

Thank you!

@Kobzol Kobzol left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good apart from the concurrency change. Once you remove it, please squash the commits, thank you! :)

View changes since this review

Comment thread .github/workflows/deploy-staging.yml Outdated
@Kobzol Kobzol mentioned this pull request Apr 14, 2026
- fix permissions
- clean up workflow changes
@yalagadapavankumar

Copy link
Copy Markdown
Contributor Author

Looks good apart from the concurrency change. Once you remove it, please squash the commits, thank you! :)

Removed the leftover concurrency and squashed the commits.

@Kobzol Kobzol left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you, looks good! Let's try.

View changes since this review

@Kobzol Kobzol added this pull request to the merge queue Apr 15, 2026
Merged via the queue into rust-lang:main with commit d6f8309 Apr 15, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants