From 88f5cf24ccdd47aebafad9aec83d6e64d50da6dd Mon Sep 17 00:00:00 2001 From: shriyatheunicorn Date: Mon, 26 Oct 2026 10:14:39 -0700 Subject: [PATCH] Harden public repository CI workflow --- .github/workflows/check.yml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index a3fcda3..486903a 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -8,9 +8,14 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} + jobs: check: runs-on: ubuntu-latest + timeout-minutes: 20 services: postgres: image: postgres:16 @@ -28,11 +33,13 @@ jobs: env: TEST_LINK_DATABASE_URL: postgresql://bell_test:bell_test@127.0.0.1:5432/bell_test steps: - - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + persist-credentials: false + - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 with: version: 10.33.4 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 24 - run: pnpm install --frozen-lockfile