Skip to content

CI hardening - #527

Merged
gkreitz merged 4 commits into
Kattis:masterfrom
gkreitz:ci_fixes
Nov 9, 2026
Merged

gkreitz merged 4 commits into
Kattis:masterfrom
gkreitz:ci_fixes

Conversation

@gkreitz

@gkreitz gkreitz commented Nov 9, 2026 •

Copy link
Copy Markdown
Contributor

Adds security hardening and fixes for our CI pipelines:

  • Pin all actions using gh actions-lock
  • Explicitly set narrow permissions (defaults are very wide)
  • Set persist-credentials: false
  • Pin ubuntu to 26.04 to prevent -latest moving from breaking our CI

@gkreitz

gkreitz commented Nov 9, 2026

Copy link
Copy Markdown
Contributor Author

Yup, still broken. I'll try to get more debug info.

Comment thread .github/workflows/python-app.yml Resolved
@gkreitz

gkreitz commented Nov 9, 2026

Copy link
Copy Markdown
Contributor Author

Ah, right. We're running our own ubuntu 24.04 container. We now get python compiled for 26.04, so libraries do not match (e.g., openssl, which kills off the ssl module).

So, presumably, bumping our docker image to 26.04 should work.

@gkreitz
gkreitz merged commit 35f1cc6 into Kattis:master Nov 9, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant