scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-05 08:07:05 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 136

fix(ci): pin the Bun runtime instead of tracking latest

Browse source 
The setup step ran `bun-version: latest`, carried over from the upstream layout,
and the step after it holds an issues: write token. A compromised Bun release
would have executed privileged in that job and could rewrite or close issues.

Pinned to 1.4.0, the release the passing runs already resolved to. setup-bun
takes no checksum input, so pinning the action by sha and the runtime by exact
version is as far as this can be hardened without hand-rolling the download.
This commit is contained in:
mubashir1osmani 2026-08-26 15:26:02 -04:00
parent 3ea11b64e6
commit f4542d9605
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
.github/workflows/auto-close-duplicates.yml vendored
View file

@ -23,7 +23,10 @@ jobs:
- name: Setup Bun
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 (sha-pinned)
with:
bun-version: latest
# Exact version, never latest: the next step holds an issues: write token,
# so a compromised Bun release would run privileged here. setup-bun exposes
# no checksum input, so pinning the action and the version is the ceiling.
bun-version: "1.4.0"
- name: Auto-close duplicate issues
run: bun run scripts/auto-close-duplicates.ts