---
title: "Open source security at Astral"
url: https://daily.dev/posts/open-source-security-at-astral-mfdglnhb3
source_url: https://astral.sh/blog/open-source-security-at-astral
type: article
source: "Astral"
published: 2026-04-08T15:21:44.076Z
updated: 2026-04-08T15:22:15.074Z
tags: ["security", "open-source", "cicd", "github-actions"]
reading_time: 17
upvotes: 92
comments: 2
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Open source security at Astral

**[Astral](https://daily.dev/sources/astral-sh)** · 17 min read · 92 upvotes · 2 comments

## Summary

Astral shares the security practices they use to protect their open source tools (Ruff, uv, ty) from supply chain attacks. Key areas covered include: hardening GitHub Actions CI/CD by banning dangerous triggers like pull_request_target, pinning all actions to commit SHAs, limiting permissions, and isolating secrets in deployment environments. For releases, they use Trusted Publishing to eliminate long-lived credentials, Sigstore-based attestations, immutable releases, and two-person approval gates. They also use GitHub Apps to safely handle tasks that GitHub Actions can't do securely, maintain dependency hygiene with Dependabot/Renovate plus cooldowns, and contribute financially and technically to upstream projects. The post includes shareable GitHub rulesets and practical recommendations for other maintainers.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://astral.sh/blog/open-source-security-at-astral>

## Community discussion

Top comments from developers on daily.dev.

**@rahmandevbd** · 0 upvotes

> ![GIF](https://media.tenor.com/eMmBGPZFDuQAAAAC/ough-ogh.gif)

**@luckyducky** · 0 upvotes

> Love the product and security practice it instills. Hate the acquisition between Astral and OpenAi.

## Similar posts on daily.dev

- [Securing the open source supply chain across GitHub](https://daily.dev/posts/securing-the-open-source-supply-chain-across-github-k6lf4rzyu) · GitHub Blog · 0 upvotes · 0 comments
- [Securing CI/CD for an open source project: Controlling who runs what](https://daily.dev/posts/securing-ci-cd-for-an-open-source-project-controlling-who-runs-what-tfpbpm5iv) · CNCF · 7 upvotes · 1 comments

---

Tags: [#security](https://daily.dev/tags/security), [#open-source](https://daily.dev/tags/open-source), [#cicd](https://daily.dev/tags/cicd), [#github-actions](https://daily.dev/tags/github-actions)

[View this post on daily.dev](https://daily.dev/posts/open-source-security-at-astral-mfdglnhb3)