Skip to content

Improve CI security#382

Merged
WildfireRomeo merged 2 commits intoWildfireRomeo:fabric-1.21.11from
Kichura:rs_fun
Jan 5, 2026
Merged

Improve CI security#382
WildfireRomeo merged 2 commits intoWildfireRomeo:fabric-1.21.11from
Kichura:rs_fun

Conversation

@Kichura
Copy link
Contributor

@Kichura Kichura commented Nov 30, 2025

What kind of PR is this?

  • Code change
    • These changes have been tested (if applicable)
  • Documentation
  • Translation
  • Other

What changes does this PR make?

  1. Changes the CI's contents permission to read-only - However use write if a specific repository absolutely requires it,
  2. Pins all job versions to their commit hashes to avoid supply chain attacks towards the workflow script,
  3. Adds the timeout-minutes to the job(s) section so that the CI doesn't take 6 hours straight to get aborted in case something is causing the CI to suddenly stall or become unresponsive, (this can be adjusted if 30 mins is too short or too long)
  4. Sets the if-no-files-found to error by default in case artifacts are absent.

(All security issues were spotted by the zizmor library)

Anything else we should know?

The changes have been borrowed from the BaseProject Repository in terms of reference, The NeoForge branch has been skipped on the other hand as it is not on 1.21.11 at the moment.

@Kichura Kichura changed the base branch from fabric-1.21.10 to fabric-1.21.11 January 2, 2026 06:36
@WildfireRomeo WildfireRomeo merged commit 1f9fc55 into WildfireRomeo:fabric-1.21.11 Jan 5, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants