From b6be3d363d8835a7a4f4ff5609cddc768aebda59 Mon Sep 17 00:00:00 2001 From: i-machine-things Date: Sun, 1 Nov 2026 21:11:22 -0800 Subject: [PATCH 1/2] Bump GitHub Actions to node24-native versions checkout v4->v7, setup-python v5->v7. Clears the "Node.js 20 is deprecated" runner warnings. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/ci.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ba38ddd..4b750fd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -10,8 +10,8 @@ jobs: lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@v7 + - uses: actions/setup-python@v7 with: python-version: "3.11" - run: pip install flake8 @@ -20,8 +20,8 @@ jobs: security: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@v7 + - uses: actions/setup-python@v7 with: python-version: "3.11" - run: pip install bandit @@ -30,8 +30,8 @@ jobs: tests: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@v7 + - uses: actions/setup-python@v7 with: python-version: "3.11" - run: | @@ -45,8 +45,8 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@v7 + - uses: actions/setup-python@v7 with: python-version: "3.11" - run: pip install -r requirements.txt From 50b54430c201c7d7eba7f6391b6dfb5f201aef67 Mon Sep 17 00:00:00 2001 From: i-machine-things Date: Sun, 1 Nov 2026 21:28:08 -0800 Subject: [PATCH 2/2] Disable credential persistence on actions/checkout steps Prevents a compromised dependency installed later in the job (pip, npm, etc.) from reading the persisted git token out of .git/config. Flagged by CodeRabbit/zizmor. Steps that pass a custom PAT for a later `git push` (e.g. CATALOG_PUSH_TOKEN, SYNC_PAT) are left alone, since they need the credential persisted. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/ci.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4b750fd..58ef138 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -11,6 +11,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - uses: actions/setup-python@v7 with: python-version: "3.11" @@ -21,6 +23,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - uses: actions/setup-python@v7 with: python-version: "3.11" @@ -31,6 +35,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - uses: actions/setup-python@v7 with: python-version: "3.11" @@ -46,6 +52,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - uses: actions/setup-python@v7 with: python-version: "3.11"