Stellarium / stellarium / 37144770530
11%

DEFAULT BRANCH: master
Ran
Jobs 1
Files 713
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 10.6%. Remained the same
37144770530

push

github

web-flow 
[GHA] Pin third-party actions by SHA and set explicit token permissions (#5120)

* [GHA] Pin third-party actions to full commit SHAs

Tags and branches are movable pointers: whoever controls the action
repository can repoint v1 or master at new code, and the next run
executes it with this workflow's token. The sharpest case here is
wyozi/contextual-qa-checklist-action@master, which runs on
pull_request_target and is handed GITHUB_TOKEN directly.

Every third-party action now references the commit its current ref
resolves to today, with the ref kept as a trailing comment, so runs
behave exactly as before. Where the ref was a floating major (v1, v2,
v3, v4) the comment names the precise release that major points to.

Three actions were on a branch. advanced-security/filter-sarif is
pinned to its v1.1 release, main only differs from it in README and
test workflow changes. wyozi/contextual-qa-checklist-action and
erclu/check-crlf stay on their current master commit: their latest
releases are older (a Node 16 runtime, and an end-of-life Debian 10
base image), so pinning those would be a downgrade.

First-party actions (actions/*, github/*) keep their tags.

* [GHA] Declare token permissions in every workflow

None of the nine workflows set permissions, so every job got the
repository default token scope. Five of them run on
pull_request_target, where the token carries the base repository's
scope even when the pull request comes from a fork. Whatever that
default is in the repository settings, it is not visible from the
workflow files.

Each workflow now defaults to contents: read, and the jobs that really
write get only what their action needs:

- auto_assign and auto_assign_sc: pull-requests: write to request
  reviewers and set the author as assignee
- checklist: pull-requests: write to post and update the QA checklist
  comment
- label-commenter: issues: write and pull-requests: write to comment,
  close, reopen and toggle draft on issues and pull reque... (continued)

14780 of 139440 relevant lines covered (10.6%)

16211.82 hits per line

Jobs
ID Job ID Ran Files Coverage
1 37144770530.1 713
10.6
GitHub Action Run
Source Files on build 37144770530