Skip to content

chore: harden GitHub Actions — pin CodeQL, explicit perms on release jobs (#99) #171

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Chris-Wolfgang merged 1 commit into from
Jun 26, 2026
Merged

chore: harden GitHub Actions — pin CodeQL, explicit perms on release jobs (#99) #171

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/codeql.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,7 @@ jobs:

- name: Initialize CodeQL
if: steps.check-csharp.outputs.has-csharp == 'true'
uses: github/codeql-action/init@v4
uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
with:
languages: ${{ matrix.language }}
# security-extended adds the broader security query pack on top of the
Expand Down Expand Up @@ -159,7 +159,7 @@ jobs:
- name: Perform CodeQL Analysis
id: perform-codeql-analysis
if: steps.check-csharp.outputs.has-csharp == 'true'
uses: github/codeql-action/analyze@v4
uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
with:
category: "/language:${{matrix.language}}"

Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ jobs:
validate-release:
name: Validate Release Build
runs-on: windows-latest
permissions: {}
if: github.repository != 'Chris-Wolfgang/repo-template'
steps:
- name: Checkout code
Expand Down Expand Up @@ -343,6 +344,7 @@ jobs:
name: Pack & Validate NuGet
needs: validate-release
runs-on: windows-latest
permissions: {}
outputs:
has-packages: ${{ steps.check-packages.outputs.has-packages }}
steps:
Expand Down Expand Up @@ -568,6 +570,7 @@ jobs:
verify-docs-build:
name: Verify Documentation Builds
runs-on: windows-latest
permissions: {}
# Gate on the prior validation jobs so we don't burn ~5-10 min of Windows
# runner time on a release that's already failing earlier in the pipeline.
needs: [validate-release, pack-and-validate]
Expand Down Expand Up @@ -665,6 +668,7 @@ jobs:
needs: [pack-and-validate, verify-docs-build]
if: needs.pack-and-validate.outputs.has-packages == 'true'
runs-on: windows-latest
permissions: {} # NuGet auth uses NUGET_API_KEY, not GITHUB_TOKEN
steps:
- name: Setup .NET
uses: actions/setup-dotnet@v5
Expand Down