code polish

Author: maxulysse

.github/workflows/build-cv.yml

@@ -11,12 +11,6 @@ on:
       - src/data/CV-MGarcia.tex
       - src/data/biblio.bib
 
-# Allow this job to clone the repo and create a cv build
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-
 # Allow one concurrent build
 concurrency:
   group: "cv"
@@ -25,13 +19,15 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
         with:
           distribution: temurin
           java-version: "17"
@@ -49,6 +45,8 @@ jobs:
   deploy:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
 
     steps:
       - name: Deploy to cv branch
@@ -58,5 +56,9 @@ jobs:
           git config --local user.name "GitHub Action"
           git checkout -B cv
           git add -f CV-MGarcia-latest.pdf
+          if git diff --staged --quiet; then
+            echo "No CV changes to commit"
+            exit 0
+          fi
           git commit -m "Update CV - $(date +%Y-%m-%d)"
           git push -f origin cv

.github/workflows/ci.yml

@@ -7,15 +7,22 @@ on:
     branches: [main]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           node-version: '24'
           cache: 'npm'
@@ -33,10 +40,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           node-version: '24'
           cache: 'npm'

.github/workflows/deploy.yml

@@ -1,4 +1,4 @@
-name: Deploy to GitHub Pages
+name: Deploy
 
 on:
   # Allows you to run this workflow manually from the Actions tab on GitHub.
@@ -18,12 +18,6 @@ on:
       - "!src/data/CV-MGarcia.tex"
       - "!src/data/biblio.bib"
 
-# Allow this job to clone the repo and create a page deployment
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-
 # Allow one concurrent deployment
 concurrency:
   group: "pages"
@@ -32,25 +26,30 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout your repository using git
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Install, build, and upload your site
-        uses: withastro/action@v6
+        uses: withastro/action@44706356b4eb735f8b9035699eb4796241a040c4 # v6
         with:
           node-version: 24
-          package-manager: npm@latest
+          package-manager: npm
 
   deploy:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
 
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5