From c17376cc196ca08301bacc4bd9cd7b634cdb8e98 Mon Sep 17 00:00:00 2001 From: Bryan Kendall Date: Wed, 24 Jun 2026 15:04:56 -0700 Subject: [PATCH] tighten security posture of workflows --- .github/workflows/node-test.yml | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/.github/workflows/node-test.yml b/.github/workflows/node-test.yml index eb249d2..8281caa 100644 --- a/.github/workflows/node-test.yml +++ b/.github/workflows/node-test.yml @@ -11,8 +11,10 @@ jobs: check-license: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-go@v6 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + with: + persist-credentials: false + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version: "^1.18.0" - run: go install github.com/google/addlicense@latest @@ -27,8 +29,10 @@ jobs: - "24" - "26" steps: - - uses: actions/checkout@v7 - - uses: actions/setup-node@v6 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + with: + persist-credentials: false + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: ${{ matrix.node-version }} cache: npm @@ -44,8 +48,10 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-node@v6 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + with: + persist-credentials: false + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: "24" cache: npm