Skip to content

ci: Lint workflows with actionlint and zizmor, and deny token permissions by default - #832

Closed
Ziinc wants to merge 1 commit into
mainfrom
claude/speed-up-ci-aoedg6-workflow-lint
Closed

Ziinc wants to merge 1 commit into
mainfrom
claude/speed-up-ci-aoedg6-workflow-lint

Conversation

@Ziinc

@Ziinc Ziinc commented Oct 12, 2026 •

Copy link
Copy Markdown
Collaborator

Requested by Zn · project thread

@Ziinc Ziinc self-assigned this Oct 12, 2026
@Ziinc
Ziinc force-pushed the claude/speed-up-ci-aoedg6-pin-actions branch from 6b6c6d0 to 58e830c Compare October 12, 2026 06:50
@Ziinc
Ziinc force-pushed the claude/speed-up-ci-aoedg6-workflow-lint branch 2 times, most recently from abe074b to 29aa0b6 Compare October 12, 2026 11:35
@Ziinc
Ziinc force-pushed the claude/speed-up-ci-aoedg6-pin-actions branch from 58e830c to 9fbafe8 Compare October 12, 2026 11:35

Ziinc commented Oct 12, 2026

Copy link
Copy Markdown
Collaborator Author

pgTAP / supabase test db failed before any test ran: supabase/setup-cli (version: latest) couldn't resolve the latest CLI release because the GitHub API returned rate limit exceeded. This PR doesn't change that step's behaviour, and there's no fix to port. I've re-run the failed job once.


Generated by Claude Code

Base automatically changed from claude/speed-up-ci-aoedg6-pin-actions to main October 12, 2026 15:10
…ions by default

verify runs actionlint (with shellcheck) and zizmor when workflows change.
Every workflow now starts from permissions: {} and each job asks for what
it uses. Fixes what they flagged: checkouts no longer persist the token
unless the job pushes, untrusted expressions move into env vars, and a few
shellcheck warnings.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Uwdgq12RrXjifDLXargwye

This branch was successfully deployed

1 active deployment
preview — e61b2a1e Deployed Oct 12, 2026 by Ziinc via build #1940
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants