ci: harden privileged workflow trust boundaries

2026-07-15 07:57:42 +02:00
parent 54a4b8e414
commit 0bcd00bcb6
7 changed files with 331 additions and 79 deletions
@@ -17,9 +17,17 @@ jobs:
    runs-on: ubuntu-latest

    steps:
+      - name: Require the protected main branch
+        run: |
+          if [[ "$GITHUB_REF" != "refs/heads/main" ]]; then
+            echo "Release automation may only run from refs/heads/main." >&2
+            exit 1
+          fi
+
      - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
+          ref: main
          fetch-depth: 0

      - name: Validate version format