Enhance reusable workflows#80
Open
Yaswant Pradhan (yaswant) wants to merge 171 commits into
Open
Conversation
Co-authored-by: Yaswant Pradhan <2984440+yaswant@users.noreply.github.com>
Yaswant Pradhan (yaswant)
requested a review
from James Bruten (james-bruten-mo)
June 23, 2026 13:41
There was a problem hiding this comment.
Pull request overview
This PR hardens the repository’s reusable GitHub Actions workflows by pinning third-party actions to immutable SHAs, tightening permissions/credential usage, and addressing template-injection risks while adding/adjusting linting and automation configuration.
Changes:
- Pin all third-party actions to commit SHAs and add
persist-credentials: falseto checkouts. - Reduce default token permissions (often
permissions: {}) and scope required permissions to specific jobs/steps. - Add/extend CI tooling (actionlint, zizmor, markdown lint) and introduce Dependabot/Zizmor configuration.
Reviewed changes
Copilot reviewed 23 out of 23 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| track-review-project/README.md | Updates usage examples (permissions, runner version, PAT secret wiring). |
| README.md | Formatting and readability improvements. |
| pyproject.toml | Adds new linting dependencies and configures rumdl. |
| labeler/action.yaml | Hardens composite action input handling and reduces expression interpolation in shell. |
| cla-check/README.md | Updates documentation to reflect new permission model and security notes. |
| .yamllint | Updates ignore syntax and adds comment-related rules. |
| .github/zizmor.yaml | Adds Zizmor rule suppressions for specific workflows. |
| .github/workflows/validate.yaml | Pins actions, tightens permissions, and adds security/tooling lint steps (actionlint/zizmor/rumdl). |
| .github/workflows/validate_symlinks.yaml | Pins checkout and scopes permissions/credentials. |
| .github/workflows/umdp3_fixer.yaml | Pins actions and scopes permissions/credentials. |
| .github/workflows/trigger-project-workflow.yaml | Scopes permissions to job and adjusts artifact naming. |
| .github/workflows/track-review-project.yaml | Requires PAT secret; refactors env usage; improves safety around inputs and project updates. |
| .github/workflows/sphinx-docs.yaml | Moves permissions to job level and updates pinned actions/uv settings. |
| .github/workflows/label-pr.yaml | Sets workflow-level empty permissions and scopes job permissions. |
| .github/workflows/fortran-lint.yaml | Moves risky interpolations to env/shell-safe argument assembly; pins actions and scopes permissions. |
| .github/workflows/deploy-sphinx-docs.yaml | Pins actions and scopes permissions. |
| .github/workflows/cla-check.yaml | Moves contexts to env to mitigate injection; replaces merge-ref detection and contributors comparison logic. |
| .github/workflows/check-cr-approved.yaml | Tightens permissions and adds an early PR-context guard. |
| .github/workflows/call-trigger-project-workflow.yaml | Adds top-level empty permissions and scopes job permissions. |
| .github/workflows/call-track-review-project.yaml | Adds top-level empty permissions, adds execution gating, and wires PAT secret explicitly. |
| .github/workflows/build-sphinx-docs.yaml | Pins actions, scopes permissions, and loosens requirements input. |
| .github/pull_request_template.md | Formatting tweaks and typo fixes. |
| .github/dependabot.yaml | Adds Dependabot configuration for GitHub Actions updates with grouping/major blocking. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+29
to
+31
| permissions: | ||
| actions: read # Required to view the status of the upstream triggered workflow run | ||
| repository-projects: write # Required to add or mutate tasks inside GitHub Project 376 |
Comment on lines
245
to
+255
| item_id=$(gh api graphql -f query=' | ||
| mutation($project:ID!, $pr:ID!) { | ||
| addProjectV2ItemById(input: {projectId: $project, contentId: $pr}) { | ||
| item { id } | ||
| } | ||
| }' -f project="$project_id" -f pr="$PR_ID" --jq '.data.addProjectV2ItemById.item.id') | ||
|
|
||
| # Update all fields in single mutation | ||
| if [[ -z "$item_id" ]]; then | ||
| echo "::warning::Could not resolve Project Board Item ID. PR may already be tracked." | ||
| exit 0 | ||
| fi |
| | xargs -r uv run shellcheck -S warning \ | ||
| && echo "All checks passed!" | ||
|
|
||
| # Run shellcheck on discoverd files, treating warnings as errors |
Comment on lines
+107
to
+117
| ARGS=() | ||
|
|
||
| [ "$RESPECT_GITIGNORE" = "true" ] && ARGS+=("--respect-gitignore") | ||
| [ "$SHOW_FIXES" = "true" ] && ARGS+=("--show-fixes") | ||
| [ "$SHOW_STATISTICS" = "true" ] && ARGS+=("--statistics") | ||
|
|
||
| uvx --from "fortitude-lint==$FORTITUDE_VERSION" fortitude check \ | ||
| "${ARGS[@]}" \ | ||
| "--file-extensions=$FILE_EXTENSIONS" \ | ||
| ${CONFIG_PATH:+"--config-file=$CONFIG_PATH"} \ | ||
| "$SOURCE_PATH" |
….toml and conf.py, and update virtual environment caching logic
This was referenced Jul 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Summary
Hardens the GitHub Actions security baseline across all workflows.
Code Reviewer: James Bruten (@james-bruten-mo)
Downstream pull requests
List of downstream PR's need coordinated merge.
Action pinning
actions/checkout@v6→@df4cb1c…).actions/github-scriptintrack-review-project.yamlupgraded fromv8 → v9as part of the pin.Credential & permission scoping
persist-credentials: falseadded to everyactions/checkoutsteppermissions: {}set on caller workflows; granularcontents: read/pull-requests: write/actions: readpushed down to job level incall-track-review-project.yaml,call-trigger-project-workflow.yaml, andtrigger-project-workflow.yamlfortran-lint.yamlgains an explicit contents: read job permission.Template-injection fixes (zizmor)
cla-check.yaml: step outputs andinputs.cla-urlmoved toenv:vars, read viaprocess.env.*in thegithub-scriptblock.fortran-lint.yaml: all string/path inputs moved toenv:vars; boolean flags resolved in shell using a bash array.track-review-project.yaml:inputs.project_organdinputs.project_numbermoved toenv:vars. Also, includedPROJECT_ACTION_PATsecret as required parameter to avoid secret inheritance in caller workflow (breaking change! See updated README for usage).CLA workflow logic
git ls-remote → gh api repos/.../pulls/…(avoids unauthenticated git network call).CONTRIBUTORS.mdmodification check rewritten:git diff→ GitHub Contents API +base64 | tr | cmp(avoids authenticated git fetch from fork). File modification now checked against content instead of just file state.Tooling & config
dependabot.yaml: monthly schedule, major-version updates blocked, all action updates grouped into a single PRzizmor.yaml: suppressesunpinned-uses,dangerous-triggers, andsecrets-inheritfor the two caller workflows that usesecrets: inherit.yamllint: updatedignoresyntax; addedcommentsandcomments-indentationrules.To enforce strict GitHub Actions security baselines, we now use immutable 40-character commit SHAs.
✅ Code Quality Checklist
(Some checks are automatically carried out via the CI pipeline)
🤖 AI Assistance and Attribution
💻 Code Review