Harden GitHub Actions workflows

[pancakereport]

GitHub flagged test.yml as possibly malicious, and its runs on main have been held for approval since. The cause was a pattern already in the workflow: toJSON(secrets) and toJSON(vars) were passed to a third-party action on a tag its owner can move (oNaiPs/secrets-to-env-action@v1). If that tag were compromised, every repo secret would leak.

Changes

• test.yml and a11y.yml: remove secrets-to-env-action. Each job's env: block now maps only the variables and secrets the app reads. The fork-PR dummy defaults are folded in with ||.
• Pin third-party actions to commit SHAs: codecov-action and the google-github-actions steps in pr-staging.yml, which can get GCP deploy credentials. Each pin is the commit its current tag points to, so the actions run the same code as before.
• Add .github/dependabot.yml so pinned versions get weekly update PRs:
  • github-actions: the SHA pins in the workflows.
  • pip: the pinned packages in both requirements.txt and requirements-dev.txt (Dependabot reads every requirements .txt file in the directory). For example, pip-audit currently reports PYSEC-2026-4312 in Werkzeug==3.1.8, fixed in 3.1.9. It only affects Windows/NTFS, so not this app, but the Audit workflow's pip-audit || true never fails CI on it.
  • Cooldown: Dependabot only proposes a release once it's 7 days old (its default is 3), so a malicious release is more likely to be caught before it shows up here.
  • Pins only help if updates are reviewed: Dependabot doesn't vet releases. Before merging one of its PRs, check the release it moves to (for an action, that the new SHA is the release it claims to be).
• Skip preview deploys on Dependabot PRs (pr-staging.yml): a Dependabot PR runs its own updated workflows before review, and the deploy job's permissions: grant id-token: write even on Dependabot runs. A bumped google-github-actions pin would otherwise run, unreviewed, with the staging deployer's GCP access. That account has project-wide roles in staging-cdss-web-apps, including run.admin and iam.serviceAccountUser. Dependabot PRs only change action pins and requirement pins, which the test workflows still check; a preview isn't worth giving them that access. To preview a package bump anyway, open your own PR with it.
• Narrow permissions:
  • a11y.yml goes down to contents: read; it never comments.
  • pr-staging.yml moves id-token, issues and pull-requests write from the whole workflow onto only the jobs that need them.
• test.yml uses actions/checkout@v7 to match the other workflows.
• Replace pytest-coverage-comment with Codecov flags:
  • Before: Codecov already commented coverage on every PR, but merged the unit and e2e uploads into one number, and the separate MishaKav/pytest-coverage-comment action added two more comments.
  • Now: each Codecov upload is labeled with its test type (flags: unit / flags: e2e), and codecov.yml adds the flags table to Codecov's comment, so one comment shows both. Codecov waits for both uploads (after_n_builds: 2) before commenting or setting its checks, so neither ever reflects only the unit tests.
  • Per-file report: still on the run's summary page, now for every run rather than only fork PRs.
  • Permissions: with the comment action gone, test.yml drops pull-requests: write and issues: write and is read-only.

audit.yml, lint.yml and codeql.yml are read-only and use only GitHub's own actions, so they're unchanged.

Note

If tests later need a new repo variable or secret, it has to be added to the env: block in test.yml / a11y.yml. The jobs no longer receive every variable and secret automatically.

🤖 Generated with Claude Code

[github-actions]

Coverage for unit tests for Python 3.14

File	Stmts	Miss	Cover	Missing
server
__init__.py	52	4	92%	55, 65–67, 87
cache.py	6	1	83%	12
forms.py	138	14	90%	24–26, 42–44, 71, 94, 169–172, 179, 187
models.py	211	26	88%	60, 64, 67, 70, 73, 76–81, 143–152, 182, 200, 257, 260, 283, 327, 341
views.py	767	513	33%	39, 49–85, 95–129, 140–144, 161–170, 186–203, 214–221, 230–252, 263–276, 285, 296–299, 317–318, 320–325, 327–328, 342–366, 375–397, 406–433, 450–452, 462–504, 544–574, 583–613, 633, 647–650, 652–655, 664–694, 703–720, 751–755, 764–810, 816–868, 880–882, 889–910, 918–939, 971, 995, 1040–1049, 1051, 1066–1067, 1072–1085, 1099, 1104, 1131–1132
server/controllers
__init__.py	82	17	79%	27–28, 36–39, 43, 72, 76, 85, 101–110
auth_controllers.py	40	23	42%	22–51, 57–59
health_controllers.py	21	7	67%	18–19, 24–28
server/services/auth
__init__.py	28	3	89%	25–26, 30
server/services/canvas
__init__.py	80	61	24%	18–25, 29, 33, 37, 43, 55–64, 69–105, 109–124, 128
fake_canvas.py	39	26	33%	9, 12, 15, 20–25, 28–29, 37–46, 49–56
server/services/core
assign.py	76	3	96%	25, 28, 114
data.py	61	34	44%	13–18, 22–26, 30–34, 38–40, 44–55, 90–92, 101–102, 106–107
export.py	27	6	78%	37–39, 41–43
room.py	61	18	70%	11–33, 57, 70–71, 74
student.py	192	5	97%	33, 37–38, 47, 284
server/services/email
__init__.py	50	3	94%	47, 74, 92
smtp.py	100	25	75%	20, 60–62, 84–92, 104–105, 117–124, 128–130, 141–142
server/services/email/templates
__init__.py	33	1	97%	20
server/typings
exception.py	34	4	88%	42, 53, 59–60
server/utils
date.py	7	1	86%	30
misc.py	16	7	56%	13–19
TOTAL	2391	802	66%

Tests	Skipped	Failures	Errors	Time
300	0 💤	0 ❌	0 🔥	12.432s ⏱️

[github-actions]

Coverage for e2e tests for Python 3.14

File	Stmts	Miss	Cover	Missing
server
__init__.py	52	12	77%	13, 16–22, 27, 55, 65–67, 87
cache.py	6	1	83%	12
forms.py	138	21	85%	24–26, 42–44, 69–71, 93–99, 169–172, 179, 187
models.py	211	70	67%	27, 60, 64, 67, 70, 73, 76–81, 111, 126–132, 136, 140, 143–152, 161–162, 169–170, 177–182, 189–197, 200, 214, 217–219, 222, 226, 238, 242, 246, 250–251, 257, 260, 280, 283, 304, 309, 314, 319, 324, 327, 341
views.py	767	656	14%	38–40, 49–85, 95–129, 140–144, 161–170, 186–203, 214–221, 230–252, 263–276, 285, 296–299, 310–329, 342–366, 375–397, 406–433, 442–453, 462–504, 515–523, 531–535, 544–574, 583–613, 622–655, 664–694, 703–720, 726–729, 739–746, 751–755, 764–810, 816–868, 874–884, 889–910, 915–945, 950–954, 962–972, 976–978, 983–1016, 1026–1030, 1037–1061, 1066–1067, 1072–1085, 1094, 1099, 1104, 1120–1136, 1146–1147
server/controllers
__init__.py	82	46	44%	26–44, 47–49, 60–87, 90, 101–110, 113
auth_controllers.py	40	26	35%	14–16, 22–51, 57–59
dev_login_controllers.py	58	44	24%	17–30, 35–52, 60–61, 68–79, 84–101
health_controllers.py	21	12	43%	9, 14–19, 24–28
server/services/auth
__init__.py	28	7	75%	25–26, 30, 62–63, 68–69
server/services/canvas
__init__.py	80	61	24%	18–25, 29, 33, 37, 43, 55–64, 69–105, 109–124, 128
fake_canvas.py	39	26	33%	9, 12, 15, 20–25, 28–29, 37–46, 49–56
server/services/core
assign.py	76	58	24%	10–13, 16, 19, 22, 25, 28, 36, 40–46, 54–55, 63, 67, 84–149, 163–180
data.py	61	41	33%	13–18, 22–26, 30–34, 38–40, 44–55, 62, 72–74, 79, 90–92, 96–97, 101–102, 106–107
export.py	27	22	19%	11–46
layout_preview.py	92	57	38%	81, 85, 90, 94, 105–110, 116–119, 128–130, 140, 147, 159–162, 167–171, 175–177, 199–200, 206–209, 218–222, 227, 239–259
room.py	61	56	8%	11–33, 41–89
student.py	192	159	17%	33, 37–38, 42, 46–48, 57–60, 70–72, 79, 88–93, 104–107, 110–114, 122–136, 140–143, 152–157, 161, 165, 172–307
server/services/csv
__init__.py	26	17	35%	11–12, 20, 27–30, 40, 54–56, 63–68
server/services/email
__init__.py	50	38	24%	23–40, 44–81, 90–101
smtp.py	100	78	22%	20, 28–41, 49–50, 54–63, 68–93, 99–131, 136–142
server/services/email/templates
__init__.py	33	23	30%	9–11, 14–17, 20, 30–41, 45–47
server/services/google
__init__.py	55	39	29%	21–36, 40–43, 47–53, 57–76
server/typings
exception.py	34	13	62%	20–36, 42, 47, 53, 59–60, 69, 72
server/utils
date.py	7	4	43%	17–19, 30
misc.py	16	13	19%	5–9, 13–19, 23
TOTAL	2391	1600	33%

Tests	Skipped	Failures	Errors	Time
14	0 💤	0 ❌	0 🔥	42.340s ⏱️

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 66.45%. Comparing base (77fe711) to head (b934a2c).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #130   +/-   ##
=======================================
  Coverage   66.45%   66.45%           
=======================================
  Files          29       29           
  Lines        2391     2391           
=======================================
  Hits         1589     1589           
  Misses        802      802           

Flag	Coverage Δ
e2e	33.08% <ø> (?)
unit	66.45% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🚀 Staging Preview Deployed!

URL: https://preview-seating-pr-130-137456085712.us-west1.run.app

[cycomachead]

It's honestly not clear to me that the security of this kind of pin vs the potential for breaking / needing to pay attention to a CI tool in the future is worth it (given this is a trusted org...)

[pancakereport]

The added workflow in this PR .github/dependabot.yml should partially automate updating pins (i.e. open PRs when pins can be updated). We'd need to review/merge still.