cluster

commit 40291a9c9e551c6e8dc15950ab333fc7ab8665d5
parent 6b08306edae2505b3b2cde7ce1092444426ac77e
Author: MTRNord <MTRNord@users.noreply.github.com>
Date:   Tue, 24 Mar 2026 15:23:16 +0100

ci hardening

Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>

Diffstat:
M
.github/workflows/build-continuwuity.yaml
 | 
2
++
M
.github/workflows/docs.yml
 | 
1
+
M
.github/workflows/validate.yaml
 | 
13
++++++++++---

3 files changed, 13 insertions(+), 3 deletions(-)
diff --git a/.github/workflows/build-continuwuity.yaml b/.github/workflows/build-continuwuity.yaml
@@ -22,6 +22,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
@@ -21,6 +21,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
diff --git a/.github/workflows/validate.yaml b/.github/workflows/validate.yaml
@@ -27,9 +27,11 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Flux CLI
-        uses: fluxcd/flux2/action@main
+        uses: fluxcd/flux2/action@580ef30c8f2b7be175d81bfe8d966314c6617faf # main
 
       - name: Setup tools
         run: |
@@ -68,6 +70,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Run gitleaks
         uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2
@@ -112,7 +115,7 @@ jobs:
           cat /tmp/images_final.txt
 
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # master
         with:
           scan-type: "config"
           scan-ref: "."
@@ -135,6 +138,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup tools
         run: |
@@ -153,7 +158,7 @@ jobs:
           ls -la manifests/
 
       - name: Run Kubescape
-        uses: kubescape/github-action@main
+        uses: kubescape/github-action@47d8e4561a2a1be8e22a4edfbd02c0b97f7335cb # main
         continue-on-error: true
         with:
           files: "manifests/"
@@ -174,6 +179,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: YAML Lint
         uses: ibiqlik/action-yamllint@2576378a8e339169678f9939646ee3ee325e845c # v3