From bad0295fb9455116b15358a8d8d1668fbf4edf88 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lukas=20D=C3=BCrrenberger?= Date: Sat, 3 Oct 2026 12:48:03 +0200 Subject: [PATCH] Harden our GitHub Actions workflows --- .github/workflows/ci.yml | 10 ++++++++++ .github/workflows/nuget.yml | 14 +++++++++++++- .github/workflows/release.yml | 12 ++++++++++++ 3 files changed, 35 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6a6514c..4e0a94f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -2,6 +2,8 @@ name: CI on: [push, pull_request, workflow_dispatch] +permissions: {} + concurrency: group: environment-${{github.ref}} cancel-in-progress: true @@ -50,6 +52,7 @@ jobs: - name: Checkout SFML uses: actions/checkout@v7 with: + persist-credentials: false repository: SFML/SFML ref: ${{env.SFML_VERSION}} path: SFML @@ -68,6 +71,7 @@ jobs: - name: Checkout CSFML uses: actions/checkout@v7 with: + persist-credentials: false path: CSFML - name: Configure CSFML CMake @@ -97,6 +101,8 @@ jobs: - name: Checkout Code uses: actions/checkout@v7 + with: + persist-credentials: false - name: Format Code run: cmake -DCLANG_FORMAT_EXECUTABLE=clang-format-17 -P cmake/Format.cmake @@ -124,6 +130,7 @@ jobs: - name: Checkout SFML uses: actions/checkout@v7 with: + persist-credentials: false repository: SFML/SFML ref: ${{env.SFML_VERSION}} path: SFML @@ -137,6 +144,7 @@ jobs: - name: Checkout CSFML uses: actions/checkout@v7 with: + persist-credentials: false path: CSFML - name: Configure CSFML CMake @@ -164,6 +172,7 @@ jobs: - name: Checkout SFML uses: actions/checkout@v7 with: + persist-credentials: false repository: SFML/SFML ref: ${{env.SFML_VERSION}} path: SFML @@ -177,6 +186,7 @@ jobs: - name: Checkout CSFML uses: actions/checkout@v7 with: + persist-credentials: false path: CSFML - name: Configure CSFML diff --git a/.github/workflows/nuget.yml b/.github/workflows/nuget.yml index 5143aa7..3cebbb0 100644 --- a/.github/workflows/nuget.yml +++ b/.github/workflows/nuget.yml @@ -9,6 +9,8 @@ on: - "**" workflow_dispatch: {} +permissions: {} + concurrency: group: nuget-${{github.ref}} cancel-in-progress: true @@ -25,6 +27,7 @@ jobs: - name: Checkout CSFML uses: actions/checkout@v7 with: + persist-credentials: false path: CSFML - name: Build x86 @@ -53,6 +56,7 @@ jobs: - name: Checkout CSFML uses: actions/checkout@v7 with: + persist-credentials: false path: CSFML - name: Build ARM64 @@ -77,6 +81,7 @@ jobs: - name: Checkout CSFML uses: actions/checkout@v7 with: + persist-credentials: false path: CSFML - name: Build @@ -100,6 +105,7 @@ jobs: - name: Checkout CSFML uses: actions/checkout@v7 with: + persist-credentials: false path: CSFML - name: Install dependencies & cross compiler @@ -129,6 +135,7 @@ jobs: - name: Checkout CSFML uses: actions/checkout@v7 with: + persist-credentials: false path: CSFML - name: Install dependencies @@ -159,6 +166,7 @@ jobs: - name: Checkout CSFML uses: actions/checkout@v7 with: + persist-credentials: false path: CSFML - name: Build @@ -182,6 +190,7 @@ jobs: - name: Checkout CSFML uses: actions/checkout@v7 with: + persist-credentials: false path: CSFML - name: Install necessary tooling @@ -218,6 +227,7 @@ jobs: - name: Checkout CSFML uses: actions/checkout@v7 with: + persist-credentials: false path: CSFML - name: Download Artifacts uses: actions/download-artifact@v8 @@ -230,7 +240,9 @@ jobs: with: dotnet-version: 10.0.x - name: Enforce SDK Version - run: dotnet new globaljson --sdk-version ${{ steps.setup-dotnet.outputs.dotnet-version }} --force + env: + DOTNET_VERSION: ${{ steps.setup-dotnet.outputs.dotnet-version }} + run: dotnet new globaljson --sdk-version "$DOTNET_VERSION" --force - name: Verify SDK Installation run: dotnet --info - name: Build NuGet Package diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index dbb081b..9bb5295 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -9,6 +9,8 @@ on: - "**" workflow_dispatch: {} +permissions: {} + concurrency: group: release-${{github.ref}} cancel-in-progress: true @@ -43,6 +45,7 @@ jobs: - name: Checkout SFML uses: actions/checkout@v7 with: + persist-credentials: false repository: SFML/SFML ref: ${{ env.SFML_VERSION }} path: SFML @@ -50,6 +53,7 @@ jobs: - name: Checkout CSFML uses: actions/checkout@v7 with: + persist-credentials: false path: CSFML - name: Build SFML @@ -130,6 +134,7 @@ jobs: - name: Checkout SFML uses: actions/checkout@v7 with: + persist-credentials: false repository: SFML/SFML ref: ${{ env.SFML_VERSION }} path: SFML @@ -137,6 +142,7 @@ jobs: - name: Checkout CSFML uses: actions/checkout@v7 with: + persist-credentials: false path: CSFML - name: Build SFML @@ -199,6 +205,7 @@ jobs: - name: Checkout SFML uses: actions/checkout@v7 with: + persist-credentials: false repository: SFML/SFML ref: ${{ env.SFML_VERSION }} path: SFML @@ -206,6 +213,7 @@ jobs: - name: Checkout CSFML uses: actions/checkout@v7 with: + persist-credentials: false path: CSFML - name: Build SFML @@ -238,6 +246,7 @@ jobs: - name: Checkout SFML uses: actions/checkout@v7 with: + persist-credentials: false repository: SFML/SFML ref: ${{ env.SFML_VERSION }} path: SFML @@ -245,6 +254,7 @@ jobs: - name: Checkout CSFML uses: actions/checkout@v7 with: + persist-credentials: false path: CSFML - name: Build SFML @@ -301,6 +311,7 @@ jobs: - name: Checkout SFML uses: actions/checkout@v7 with: + persist-credentials: false repository: SFML/SFML ref: ${{ env.SFML_VERSION }} path: SFML @@ -308,6 +319,7 @@ jobs: - name: Checkout CSFML uses: actions/checkout@v7 with: + persist-credentials: false path: CSFML - name: Build SFML run: |