I recently merged my latest pull request to the HEP Software Foundation (HSF) repository, and I'm super excited about it! My PR, titled "fix(release): add OIDC permissions, pin action versions, fix exports warnings", focused on hardening our release pipeline and cleaning up noisy build outputs.
Specifically, I updated our CI/CD workflows to use OpenID Connect (OIDC) for safer, tokenless authentication during releases. To protect against supply-chain vulnerabilities, I pinned all GitHub Action versions to exact commit SHAs. Lastly, I resolved a few pesky package export warnings that had been cluttering our build logs for weeks.
The code review process was an awesome learning experience. One of the maintainers, Alex, left a friendly comment thanking me for tackling the security debt. They suggested a quick tweak to scope the OIDC permissions to write-only for ID tokens, ensuring we followed the principle of least privilege. We had a short, constructive back-and-forth, and once the final CI checks turned green, Alex approved it with a virtual high-five emoji.
Working on this taught me so much about modern DevOps practices. I had never configured OIDC before, so diving into workflow security was a huge lightbulb moment. It’s incredibly rewarding to know my small fixes helped make HSF’s software supply chain a little safer!