Skip to content

ci: harden GitHub Actions workflows against Scorecard and CodeQL alerts #310

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TheGupta2012 merged 7 commits into from
Oct 26, 2026
Merged

ci: harden GitHub Actions workflows against Scorecard and CodeQL alerts #310

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
7302f1f
ci: pin every workflow action to a commit SHA
TheGupta2012 Oct 26, 2026
2b23586
ci: declare least-privilege GITHUB_TOKEN permissions in every workflow
TheGupta2012 Oct 26, 2026
e404a07
ci: install workflow Python tools from hash-locked requirements
TheGupta2012 Oct 26, 2026
3b546e4
ci(lab-env): install the qBraid CLI from a hash-locked requirements file
TheGupta2012 Oct 26, 2026
ca818be
docs(changelog): note the workflow hardening
TheGupta2012 Oct 26, 2026
e865fe2
ci: build with the hash-locked setuptools and wheel, without isolation
TheGupta2012 Oct 26, 2026
6e54774
ci: compile the build lock from Python 3.10
TheGupta2012 Oct 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .gitattributes
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
# Hash-locked CI requirements, compiled by uv. GitHub collapses them in diffs.
.github/requirements/*.txt linguist-generated=true
9 changes: 8 additions & 1 deletion .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,4 +12,11 @@ updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
interval: "weekly"
- package-ecosystem: "uv"
directory: "/.github/requirements"
schedule:
interval: "weekly"
groups:
workflow-tools:
patterns: ["*"]
5 changes: 5 additions & 0 deletions .github/requirements/build.in
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
build
# The build backend from pyproject.toml. Builds run with --no-isolation so these
# hash-locked copies are used, not ones downloaded at build time.
setuptools>=77
wheel
103 changes: 103 additions & 0 deletions .github/requirements/build.txt
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions .github/requirements/bump-version.in
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
qbraid-core>=0.1.17
pyyaml
Loading
Loading