From 5d8957a5db80fd5981fb6ef859f7413be6e9eef3 Mon Sep 17 00:00:00 2001 From: cpovirk Date: Mon, 3 Aug 2026 09:13:07 -0700 Subject: [PATCH] Enact some security improvements that I'd missed in previous rounds. For each project, that includes some subset of: - `zizmor` fixes (this time for [excessive permissions](https://docs.zizmor.sh/audits/#excessive-permissions)): compare https://github.com/google/compile-testing/commit/f820a82143ae801e500816dede971e565b3d266b (or cl/957369925 for excessive permissions specifically) - migration off `styfle/cancel-workflow-action` (which requires write permissions): compare cl/947083935 - Relatedly, set up cancellation for bazel_common using the replacement we're using elsewhere (`concurrency`), since bazel_common didn't have cancellation set up at all yet. - Dependabot `cooldown`: compare https://github.com/google/compile-testing/commit/26a52c774cdd7d108fee314c2915313fa12aa930 RELNOTES=n/a PiperOrigin-RevId: 958410064 --- .github/workflows/ci.yml | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4cc7c875..e878eaa9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -8,6 +8,14 @@ on: branches: - main +permissions: + contents: read + +# Cancel in-progress runs for pull requests, but not for master branch pushes +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} + cancel-in-progress: true + jobs: test: name: "JDK ${{ matrix.java }}" @@ -16,11 +24,6 @@ jobs: java: [ 8, 11, 17, 21 ] runs-on: ubuntu-latest steps: - # Cancel any previous runs for the same branch that are still running. - - name: 'Cancel previous runs' - uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 - with: - access_token: ${{ github.token }} - name: 'Check out repository' uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: