ci: harden docs.yml and release.yml from the chant audit (#287) - #289
Merged
Conversation
docs.yml: pin all four actions to full commit SHAs (GHA021/GHA029), move the pages+id-token write grants from workflow-wide onto the deploy job (GHA034), and give deploy a timeout-minutes (GHA022). release.yml: gate the publish job behind an `environment: release` (GHA026) so protection rules can be attached in repo settings, and the npm trusted-publisher record can pin to it. Closes #287 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JD1XEfzQByQEP29dMhJgvz
lex00
added a commit
that referenced
this pull request
Aug 10, 2026
The release.yml rehearsal after #289 annotated both v4 pins as targeting the deprecated Node 20 runtime. Same v6 SHAs docs.yml already uses, so all three workflows now pin the same versions. Claude-Session: https://claude.ai/code/session_01JD1XEfzQByQEP29dMhJgvz Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears the workflow-hardening half of #287 (the dependabot npm alerts stay a separate lane).
checkout,setup-node,upload-pages-artifact,deploy-pagespinned to full commit SHAs (same idiom ci.yml and release.yml already use); the SHAs are whatv6/v6/v3/v5resolve to today.pages: write+id-token: writemove from workflow-wide onto the deploy job. The build job — the one that runs on every PR — now has onlycontents: read.timeout-minutes: 10on deploy.environment: release. GitHub creates the environment on first run; protection rules (required reviewers, wait timers) can then be attached in repo settings without touching the workflow, and the npm trusted-publisher record can name the environment to reject publishes from outside it.The PR's own docs run exercises the pinned build path (deploy is gated off
pull_request). release.yml can be rehearsed post-merge withgh workflow run release.yml— dispatch runs everything but the tag-gated publish steps.Closes #287
🤖 Generated with Claude Code
https://claude.ai/code/session_01JD1XEfzQByQEP29dMhJgvz