zostera / django-marina / 37189392197

100%

push

github

Harden the workflows, and write down the dependency update policy (#687)

A zizmor audit of the five packages returned the same 32 findings in each,
since the workflows are synced. This fixes the three that are not about
pinning, and records the policy the dependabot workflow implements.

The dependabot job gated on `github.actor`, which a pull_request_target
workflow cannot trust. It now gates on the pull request author. The practical
risk was low, because the fetch-metadata step is a second gate that fails for
any pull request Dependabot did not raise, and because the job never checks
out the branch, so no code from the pull request runs. It is still the wrong
check to have first.

ci.yml had no permissions block, so its five jobs inherited a write-capable
token to read a repository and run tests. It now declares contents: read.

release.yml let setup-uv restore a shared cache in the job that builds and
publishes to PyPI. A poisoned cache entry there would reach the uploaded
artifacts, so caching is off in that job.

MAINTAINING.md gains a Dependency updates section: what merges automatically,
what waits for a person, and the three properties that make leaving it running
reasonable. It also records why "Allow GitHub Actions to create and approve
pull requests" is enabled, so nobody turns it off thinking it is a hardening.

zizmor goes from 50 findings to 42, and from 9 medium to 3. What remains is
15 unpinned-uses, 1 dangerous-triggers for the pull_request_target itself,
3 unpinned-tools and 5 artipacked. Pinning actions by commit hash is a bigger
decision and belongs in its own change.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

28 of 28 branches covered (100.0%)

Branch coverage included in aggregate %.

164 of 164 relevant lines covered (100.0%)

16.0 hits per line