From 1fc5be641f1e7e38d94d21aef92238c44f8be04c Mon Sep 17 00:00:00 2001
From: Rik Huijzer <github@huijzer.xyz>
Date: Thu, 10 Apr 2025 03:07:53 +0200
Subject: [PATCH] ci: harden release action (#113)

---
 .github/workflows/ci.yml | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index af1caba..9d39053 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -156,12 +156,19 @@ jobs:
     if: github.ref == 'refs/heads/release' || startsWith(github.ref, 'refs/tags/release')
     needs: [fmt, clippy, test]
     steps:
-      - uses: actions/checkout@v3
+      # Since this job has access to the `CRATES_TOKEN`, it's probably a good
+      # idea to be extra careful about what Actions are being called. The reason
+      # is that if an attacker gains access to other actions such as
+      # `Swatinem/rust-cache`, they could use that to steal the `CRATES_TOKEN`.
+      # This happened recently in the attack on `tj-actions/changed-files`, but
+      # has happened many times before as well.
 
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@v4
 
-      - uses: Swatinem/rust-cache@v2
+      - name: Update Rust
+        run: | 
+          rustup update stable
+          rustup default stable
 
       - name: Cargo login
         run: cargo login ${{ secrets.CRATES_TOKEN }}