Repository navigation
ci: least-privilege Pages token in e2e-kvm, pin actions to digests, hold the noble runner pins - #572
Merged
Merged
Conversation
…old the noble runner pins - e2e-kvm.yml gave pages:write and id-token:write to every job, including the self-hosted e2e job, which only needs to read the repository. The top level is now contents:read and only deploy-pages gets the Pages token. Every other workflow already had a top-level permissions block, so this is the one real gap behind #519/#521/#540. - renovate: extend helpers:pinGitHubActionDigests, so Renovate pins every action to a commit SHA (with the tag as a comment) and keeps it current (#560). - renovate: stop proposing a newer runner for the four workflows that pin ubuntu-24.04 on purpose. host-data.py resolves the noble suites, and PR #491 (ubuntu 26) fails their package closure. Refs #519, #560 Assisted-by: Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017rgdDrtF1Kz1pxzxfcwBUb
This was referenced Oct 8, 2026
This was referenced Oct 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Workflow permissions (#519, #521, #540)
permissions:block. These three bot issues come from a false-positive scan, so I will close them as duplicates of [sec-check] wootc: missing top-level permissions blocks in 5 workflows #519.e2e-kvm.yml. It grantedpages: writeandid-token: writeat the top level, so the self-hostede2ejob got them too.contents: read.deploy-pagesgets the Pages token.Pin actions to commit SHAs (#560)
renovate.jsonnow extendshelpers:pinGitHubActionDigests.uses:to a digest, with the tag kept as a comment, and will keep the pins current after that.ste-lint.yml@mainstays onmain. Pinning it is your call.Hold the ubuntu-24.04 runner pins (#491)
ubuntu-24.04on purpose:linux-package-execute,linux-package-runtime,offline-image-bundleandoffline-release-plan.tests/e2e/package-runtime/host-data.py. It resolves thenoblesuites and pins the noble qemu/ovmf packages.source/controlsjobs fail withcomplete authenticated package/index closure absent.host-data.py, not on its own. I'll close chore(deps): update dependency ubuntu to v26 #491.Validation
yamllint -d relaxedpasses on the changed workflow; it gives only the existing line-length warnings.actionlintreports nothing new; its one finding is the existing customkvmrunner label.renovate.jsonparses as JSON.Refs #519, #560
🤖 Generated with Claude Code
https://claude.ai/code/session_017rgdDrtF1Kz1pxzxfcwBUb
Generated by Claude Code