[SECURITY] Harden GitHub workflows#35
Merged
John McCall (lowlydba) merged 8 commits intomainfrom Apr 8, 2026
Merged
Conversation
Signed-off-by: John McCall <john@overturemaps.org>
Signed-off-by: John McCall <john@overturemaps.org>
Enable concurrency for CI and staging workflows to group runs by workflow+ref and cancel in-progress jobs. Add explanatory comments for Pages and id-token permissions in publish-stac and note id-token usage for AWS in staging. Fix staging run steps to pass the PR number via an environment variable (GITHUB_EVENT_NUMBER) and use that env var in aws s3 sync and CloudFront invalidation commands to avoid expression interpolation issues in shell run blocks. Signed-off-by: John McCall <john@overturemaps.org>
There was a problem hiding this comment.
Pull request overview
This PR hardens the repository’s GitHub Actions configuration to address zizmor security findings by tightening GITHUB_TOKEN permissions, pinning action references to SHAs, and reducing expression-to-shell injection risk in workflow run: steps.
Changes:
- Lock down workflow-level permissions (
permissions: {}) and re-grant minimal job-level permissions where needed. - Pin all referenced GitHub Actions to specific commit SHAs and disable persisted checkout credentials.
- Add concurrency controls to reduce overlapping runs; adjust staging deploy shell interpolation; add Dependabot cooldown.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| .github/workflows/staging.yaml | Pins actions, adds concurrency, restricts permissions, and hardens shell variable usage for staging deploy. |
| .github/workflows/publish-stac.yaml | Pins actions and scopes Pages deployment permissions to the job level. |
| .github/workflows/ci.yaml | Pins actions, adds concurrency, locks down permissions, and replaces the final “all checks passed” gate with an action. |
| .github/dependabot.yml | Adds a Dependabot update cooldown window. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…-repos Signed-off-by: John McCall <john@lowlydba.com>
Signed-off-by: John McCall <john@overturemaps.org>
…ttps://github.com/OvertureMaps/stac into 306-devops-create-omf-ruleset-for-all-public-repos Signed-off-by: John McCall <john@overturemaps.org>
Signed-off-by: John McCall <john@overturemaps.org>
Signed-off-by: John McCall <john@overturemaps.org>
John McCall (lowlydba)
temporarily deployed
to
staging
GitHub Actions
Inactive
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Alex Iannicelli (atiannicelli)
approved these changes
Apr 8, 2026
Contributor
Alex Iannicelli (atiannicelli)
left a comment
Alex Iannicelli (atiannicelli)
left a comment
There was a problem hiding this comment.
lgtm
John McCall (lowlydba)
deleted the
306-devops-create-omf-ruleset-for-all-public-repos
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
This pull request fixes all outstanding issues that the zizmor 🌈 static analysis analyzer has found. Tackling these helps protect us against supply chain exploits, GitHub exploits, and more.
Going forward, this will be enforced by the new
OMF Security Checksworkflow that will be enabled in this repo (and many more) via Org ruleset, which runs the GitHub Action version of zizmor (see checks below!)Validation