From 371a3e26c5c61ec6997221f2a0862c38af0f951a Mon Sep 17 00:00:00 2001 From: Bob Callaway Date: Fri, 17 Jul 2026 21:12:13 +0000 Subject: [PATCH 1/2] set permissions, pin actions refs and omit credentials on checkout Signed-off-by: Bob Callaway --- .github/workflows/clang-format.yaml | 9 +++++++-- .github/workflows/main.yml | 7 ++++++- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/.github/workflows/clang-format.yaml b/.github/workflows/clang-format.yaml index 091574f..5c6fc40 100644 --- a/.github/workflows/clang-format.yaml +++ b/.github/workflows/clang-format.yaml @@ -1,13 +1,18 @@ name: Check clang-format on: [push, pull_request] +permissions: + contents: read jobs: formatting-check: name: Formatting Check runs-on: 'ubuntu-24.04' + steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Run clang-format style check for C/C++/Protobuf programs. - uses: jidicula/clang-format-action@v4.17.0 + uses: jidicula/clang-format-action@654a770daa28443dd111d133e4083e21c1075674 # v4.18.0 with: clang-format-version: '21' fallback-style: 'Google' # optional diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index aa8d896..404ce7c 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -13,6 +13,9 @@ on: # Allows you to run this workflow manually from the Actions tab workflow_dispatch: +permissions: + contents: read + # A workflow run is made up of one or more jobs that can run sequentially or in parallel jobs: # This workflow contains a single job called "build" @@ -23,7 +26,9 @@ jobs: # Steps represent a sequence of tasks that will be executed as part of the job steps: # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it - - uses: actions/checkout@v6 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Install extra packages run: | From 1a1372ef4cf080e7612e888b172d27dbcd2d6138 Mon Sep 17 00:00:00 2001 From: Bob Callaway Date: Thu, 27 Aug 2026 07:11:22 -0400 Subject: [PATCH 2/2] move to v7.0.1 Signed-off-by: Bob Callaway --- .github/workflows/clang-format.yaml | 2 +- .github/workflows/main.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/clang-format.yaml b/.github/workflows/clang-format.yaml index 5c6fc40..ac3a539 100644 --- a/.github/workflows/clang-format.yaml +++ b/.github/workflows/clang-format.yaml @@ -8,7 +8,7 @@ jobs: runs-on: 'ubuntu-24.04' steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Run clang-format style check for C/C++/Protobuf programs. diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 404ce7c..8c58d74 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -26,7 +26,7 @@ jobs: # Steps represent a sequence of tasks that will be executed as part of the job steps: # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false