From ce3c7a3a020d7a1ab3a23ba965d2e3c616b9ba89 Mon Sep 17 00:00:00 2001 From: Pim Feltkamp <48278217+pimfeltkamp@users.noreply.github.com> Date: Mon, 2 Nov 2026 00:56:32 +0100 Subject: [PATCH] Security: pin third-party release actions to commit SHAs pypa/gh-action-pypi-publish and softprops/action-gh-release ran on mutable refs (release/v1, v3) inside the job holding id-token: write for PyPI trusted publishing. Pin both to the commit SHAs those refs currently resolve to (v1.14.3, v3.0.3) so a hijacked upstream tag or branch cannot run in the publishing job. Dependabot keeps the pins updated via the version comments. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/release.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7625d76..5ee5c21 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -45,9 +45,9 @@ jobs: - name: Build sdist + wheel run: python -m build --sdist --wheel - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3 - name: Create GitHub Release - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 with: files: dist/* generate_release_notes: true