fix(security): least-privilege workflows, pinned actions, webview dependency updates #212

2026-10-16T21:16:57Z

KofTwentyTwo commented

2026-10-16 21:16:57 +00:00

(Migrated from github.com)

Fixes #211

Workflow hardening (Scorecard)

TokenPermissions #25-#28: workflow-level permissions are now read-only; write scopes move to the jobs that need them (publish-tag and release: contents write; dependency-review: pull-requests write; semgrep: security-events write). The unused checks: write is dropped.
PinnedDependencies #1-#24: every action is pinned to a full commit SHA with the tag as a comment; the existing github-actions Dependabot ecosystem keeps them current.

Dependencies (webview)

vitest ^3 -> ^4.1.11 in the root, bus and hud packages (critical/medium advisories).
pnpm overrides: vite >=8.0.16, undici ^7.29.1, nanoid ^3.3.12, postcss ^8.5.23, fflate ^0.8.3, source-map-js ^1.2.2.
pnpm audit: no known vulnerabilities. Resolves the 30 open Dependabot alerts; supersedes the open Dependabot PRs that touch these packages.

Verification: pnpm -r build, pnpm -r typecheck, pnpm -r test (bus 37/37, hud 101/101); all workflow files parse as YAML.

🤖 Generated with Claude Code

Fixes #211 **Workflow hardening (Scorecard)** - TokenPermissions #25-#28: workflow-level permissions are now read-only; write scopes move to the jobs that need them (`publish-tag` and `release`: contents write; `dependency-review`: pull-requests write; `semgrep`: security-events write). The unused `checks: write` is dropped. - PinnedDependencies #1-#24: every action is pinned to a full commit SHA with the tag as a comment; the existing github-actions Dependabot ecosystem keeps them current. **Dependencies (webview)** - vitest ^3 -> ^4.1.11 in the root, bus and hud packages (critical/medium advisories). - pnpm overrides: vite >=8.0.16, undici ^7.29.1, nanoid ^3.3.12, postcss ^8.5.23, fflate ^0.8.3, source-map-js ^1.2.2. - `pnpm audit`: no known vulnerabilities. Resolves the 30 open Dependabot alerts; supersedes the open Dependabot PRs that touch these packages. **Verification**: `pnpm -r build`, `pnpm -r typecheck`, `pnpm -r test` (bus 37/37, hud 101/101); all workflow files parse as YAML. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

You are not authorized to merge this pull request.

This pull request can be merged automatically.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin feature/security-findings-2026-10:feature/security-findings-2026-10

git checkout feature/security-findings-2026-10

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/Jarvis#212