ff0d1bc1b8
studio-ui-smoke.yml was the last holdout still using hardcoded rotated passwords (CIUiSmoke12345! / CIUiSmoke67890!). Generate them per-run via python -c 'import secrets; print(secrets.token_urlsafe(16))' and mask them into the log via GitHub Actions' ::add-mask::, matching the pattern already used in studio-inference-smoke.yml. If a workflow ever gets compromised (malicious dependency, leaked GITHUB_TOKEN, supply-chain attack on a pinned action), the rotated password is now unique to that single job run and is never readable from log output. An attacker cannot replay a hardcoded credential against a future / parallel Studio install elsewhere. |
||
|---|---|---|
| .. | ||
| lint-ci.yml | ||
| mlx-ci.yml | ||
| release-desktop.yml | ||
| security-audit.yml | ||
| stale.yml | ||
| studio-backend-ci.yml | ||
| studio-frontend-ci.yml | ||
| studio-inference-smoke.yml | ||
| studio-tauri-smoke.yml | ||
| studio-ui-smoke.yml | ||
| studio-update-smoke.yml | ||
| wheel-smoke.yml | ||