Skip to content

fix: harden CI workflow permissions - #180

Closed
olalois wants to merge 1 commit into
wraith-protocol:developfrom
olalois:fix/workflow-hardening
Closed

olalois wants to merge 1 commit into
wraith-protocol:developfrom
olalois:fix/workflow-hardening

Conversation

@olalois

@olalois olalois commented Sep 28, 2026

Copy link
Copy Markdown
Contributor

Summary

  • pin GitHub Actions to verified commit SHAs
  • remove implicit workflow-wide write access
  • restrict the build job to read-only repository contents

Why

This closes the workflow hygiene issue by minimizing token scope and eliminating unpinned action references.

Related issue

Closes #154

@vercel

vercel Bot commented Sep 28, 2026

Copy link
Copy Markdown

@olalois is attempting to deploy a commit to the truthixify's projects Team on Vercel.

A member of the Team first needs to authorize it.

@github-actions
github-actions Bot changed the base branch from main to develop September 28, 2026 11:04
@github-actions

Copy link
Copy Markdown
Contributor

Auto-retargeted this PR from main to develop. Wave PRs merge into develop; main is only for release cuts. If you meant to target main deliberately (rare), reply here and we can revert this.

@olalois

olalois commented Sep 28, 2026

Copy link
Copy Markdown
Contributor Author

Hello, please kindly review

@truthixify

Copy link
Copy Markdown
Contributor

This does not address #154. That issue requires Lighthouse budget failures to block CI, with an explicit override and useful failure details. Please implement that scope on the current develop workflow.

@truthixify

Copy link
Copy Markdown
Contributor

This does not implement issue #154, and the Lighthouse work is already in #178. Closing this duplicate so review stays on the correct PR.

@truthixify truthixify closed this Sep 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Wave 9] Make Lighthouse budget failures block the website build

2 participants