From c6861d3b9c7248a132146e4ca8abb03d9c95822b Mon Sep 17 00:00:00 2001 From: Matt Hammond Date: Wed, 27 May 2026 13:57:00 +0100 Subject: [PATCH 1/4] ci: disable credential persistence on checkout Set persist-credentials: false on actions/checkout so the default GITHUB_TOKEN is not left in the local git config after the checkout step completes. --- .github/workflows/check.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index afda708..b3ef045 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -15,6 +15,7 @@ jobs: uses: actions/checkout@v2 with: submodules: 'recursive' + persist-credentials: false - name: Setup Rust Toolchain uses: actions-rs/toolchain@v1 From 231062aafba6ef93bf6abab7da5ba15f87d972d2 Mon Sep 17 00:00:00 2001 From: Matt Hammond Date: Wed, 27 May 2026 13:57:15 +0100 Subject: [PATCH 2/4] ci: scope workflow and job permissions explicitly Add a top-level permissions: {} block to each workflow so no GITHUB_TOKEN scopes are granted by default, then grant each job only the scopes it actually needs: - check.yml's check job: contents: read for checkout - features.yml's build job: contents: read for checkout, plus deployments: write and id-token: write to match what the called reusable workflow declares it needs --- .github/workflows/check.yml | 4 ++++ .github/workflows/features.yml | 6 ++++++ 2 files changed, 10 insertions(+) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index b3ef045..9ce5edd 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -6,10 +6,14 @@ on: name: Check +permissions: {} + jobs: check: name: Check runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Checkout uses: actions/checkout@v2 diff --git a/.github/workflows/features.yml b/.github/workflows/features.yml index 330a046..d413930 100644 --- a/.github/workflows/features.yml +++ b/.github/workflows/features.yml @@ -6,8 +6,14 @@ on: branches: - main +permissions: {} + jobs: build: + permissions: + contents: read + deployments: write + id-token: write uses: ably/features/.github/workflows/sdk-features.yml@main with: repository-name: ably-rust From b004d01796907c9ceb027fcf0cba5c0a4167310f Mon Sep 17 00:00:00 2001 From: Matt Hammond Date: Wed, 27 May 2026 13:57:25 +0100 Subject: [PATCH 3/4] ci: pass only required secret to reusable workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace secrets: inherit, which forwards every secret available to the calling workflow, with an explicit pass-through of just ABLY_AWS_ACCOUNT_ID_SDK — the only secret the called workflow declares as required. --- .github/workflows/features.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/features.yml b/.github/workflows/features.yml index d413930..da68039 100644 --- a/.github/workflows/features.yml +++ b/.github/workflows/features.yml @@ -17,4 +17,5 @@ jobs: uses: ably/features/.github/workflows/sdk-features.yml@main with: repository-name: ably-rust - secrets: inherit + secrets: + ABLY_AWS_ACCOUNT_ID_SDK: ${{ secrets.ABLY_AWS_ACCOUNT_ID_SDK }} From 34cb2956566838755d73e729549a8a61403af7f5 Mon Sep 17 00:00:00 2001 From: Matt Hammond Date: Wed, 27 May 2026 13:57:51 +0100 Subject: [PATCH 4/4] ci: pin third-party actions to commit SHAs Replace floating tag references (@v1, @v2, @main) on third-party actions and reusable workflows with full commit SHAs, keeping the original ref as a trailing comment for readability. Pinning to a commit ensures an upstream tag or branch move cannot silently change what runs in CI. --- .github/workflows/check.yml | 12 ++++++------ .github/workflows/features.yml | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 9ce5edd..e0341b6 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -16,13 +16,13 @@ jobs: contents: read steps: - name: Checkout - uses: actions/checkout@v2 + uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 with: submodules: 'recursive' persist-credentials: false - name: Setup Rust Toolchain - uses: actions-rs/toolchain@v1 + uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1 with: profile: minimal toolchain: stable @@ -31,12 +31,12 @@ jobs: run: rustc -V - name: cargo check - uses: actions-rs/cargo@v1 + uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1 with: command: check - name: cargo test - uses: actions-rs/cargo@v1 + uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1 with: command: test @@ -44,7 +44,7 @@ jobs: run: rustup component add rustfmt - name: cargo fmt - uses: actions-rs/cargo@v1 + uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1 with: command: fmt args: --all -- --check @@ -53,7 +53,7 @@ jobs: run: rustup component add clippy - name: cargo clippy - uses: actions-rs/cargo@v1 + uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1 with: command: clippy args: -- -D warnings diff --git a/.github/workflows/features.yml b/.github/workflows/features.yml index da68039..0b1ad47 100644 --- a/.github/workflows/features.yml +++ b/.github/workflows/features.yml @@ -14,7 +14,7 @@ jobs: contents: read deployments: write id-token: write - uses: ably/features/.github/workflows/sdk-features.yml@main + uses: ably/features/.github/workflows/sdk-features.yml@6b3fc7a8ede2ebdd7a6325314f3a96c6466f1453 # main with: repository-name: ably-rust secrets: