ci: apply the CI security standard (no cache in release, pins, permissions)

.github/actions/install-dependencies/action.yml

@@ -5,14 +5,13 @@ runs:
 
   steps:
     - name: Setup Node
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version-file: .nvmrc
 
     - name: Setup PNPM
-      uses: pnpm/action-setup@v3
+      uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       with:
-        version: 10
         run_install: false
 
     - name: Get pnpm store directory
@@ -22,7 +21,7 @@ runs:
         echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
 
     - name: Setup pnpm cache
-      uses: actions/cache@v4
+      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
       with:
         path: |
           ${{ steps.pnpm-cache.outputs.STORE_PATH }}

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directories: ["/", "/.github/actions/*"]
+    schedule:
+      interval: weekly
+      day: monday
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns: ["*"]

.github/workflows/changeset-check-trigger.yml

@@ -4,10 +4,11 @@ on:
   pull_request:
     branches: [master]
 
-permissions:
-  contents: read
-  pull-requests: write
+permissions: {}
 
 jobs:
   check:
-    uses: 0xPolygon/pipelines/.github/workflows/apps-changeset-check.yml@main
+    permissions:
+      contents: read
+      pull-requests: write
+    uses: 0xPolygon/pipelines/.github/workflows/apps-changeset-check.yml@3c69da7f7438cb371c56851dab2cf00c5d7dbce6 # main

.github/workflows/claude.yml

@@ -10,6 +10,8 @@ on:
   pull_request_review:
     types: [submitted]
 
+permissions: {}
+
 jobs:
   claude:
     if: |
@@ -18,6 +20,7 @@ jobs:
       (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
       (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     permissions:
       contents: read
       pull-requests: read
@@ -26,9 +29,10 @@ jobs:
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Run Claude Code
         id: claude

.github/workflows/dependency-review.yml

@@ -0,0 +1,60 @@
+name: Dependency review
+
+on:
+  pull_request:
+
+permissions: {}
+
+jobs:
+  dependency-review:
+    name: Dependency review
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      pull-requests: write # comment-summary-in-pr
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: high
+          allow-licenses: >-
+            MIT,
+            Apache-2.0,
+            BSD-2-Clause,
+            BSD-3-Clause,
+            ISC,
+            0BSD,
+            MPL-2.0,
+            Unlicense,
+            CC0-1.0,
+            BlueOak-1.0.0,
+            BSD-2-Clause-Views,
+            CC-BY-3.0,
+            CC-BY-4.0,
+            MIT-0,
+            MITNFA,
+            PostgreSQL,
+            Python-2.0,
+            Unicode-3.0,
+            Zlib,
+            LicenseRef-scancode-google-patent-license-golang
+          # Already in the lockfile under copyleft or unparsed licence data; new
+          # dependencies with those licences still fail.
+          allow-dependencies-licenses: >-
+            pkg:npm/@img/sharp-libvips-darwin-arm64,
+            pkg:npm/@img/sharp-libvips-darwin-x64,
+            pkg:npm/@img/sharp-libvips-linux-arm,
+            pkg:npm/@img/sharp-libvips-linux-arm64,
+            pkg:npm/@img/sharp-libvips-linux-ppc64,
+            pkg:npm/@img/sharp-libvips-linux-riscv64,
+            pkg:npm/@img/sharp-libvips-linux-s390x,
+            pkg:npm/@img/sharp-libvips-linux-x64,
+            pkg:npm/@img/sharp-libvips-linuxmusl-arm64,
+            pkg:npm/@img/sharp-libvips-linuxmusl-x64,
+            pkg:npm/@img/sharp-win32-arm64,
+            pkg:npm/@img/sharp-win32-ia32,
+            pkg:npm/@img/sharp-win32-x64
+          comment-summary-in-pr: on-failure

.github/workflows/npm-release-trigger.yml

@@ -41,7 +41,7 @@ jobs:
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
-          cache: pnpm
+          package-manager-cache: false # no shared cache in the release path
           registry-url: 'https://registry.npmjs.org'
       - name: Install npm with staged-publishing support
         run: npm install --global npm@11.15.0
@@ -100,11 +100,12 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
-          cache: pnpm
+          package-manager-cache: false # no shared cache in the release path
           registry-url: 'https://registry.npmjs.org'
       - name: Install npm with staged-publishing support
         run: npm install --global npm@11.15.0

.github/workflows/on_pr_pnpm-format-label.yml

@@ -4,20 +4,28 @@ on:
   pull_request:
     types: [labeled]
 
+permissions: {}
+
 jobs:
   proto:
     if: ${{ github.event.label.name == 'pnpm format' }}
     uses: ./.github/workflows/pnpm-format.yml
-    secrets: inherit
+    permissions:
+      contents: read
+    secrets:
+      GH_TOKEN_GIT_COMMIT: ${{ secrets.GH_TOKEN_GIT_COMMIT }}
 
   rm:
     if: ${{ github.event.label.name == 'pnpm format' }}
     runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      pull-requests: write
     steps:
       - name: Remove the label
-        run: |
-          LABEL=$(echo "${{ github.event.label.name }}" | sed 's/ /%20/g')
-          curl -X DELETE \
-          -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
-          -H "Accept: application/vnd.github.v3+json" \
-          https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels/$LABEL
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          LABEL: ${{ github.event.label.name }}
+        run: gh api -X DELETE "repos/$REPO/issues/$PR_NUMBER/labels/${LABEL// /%20}"

.github/workflows/pnpm-format.yml

@@ -2,23 +2,32 @@ name: pnpm format
 
 on:
   workflow_call:
+    secrets:
+      GH_TOKEN_GIT_COMMIT:
+        required: true
+
+permissions: {}
 
 jobs:
   run:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.head_ref }}
           fetch-depth: 20
+          persist-credentials: false # the commit-back action clones with its own token
 
       - uses: ./.github/actions/install-dependencies
 
       - run: pnpm format
 
       - name: Commit back
-        uses: 0xsequence/actions/git-commit@v0.0.4
+        uses: 0xsequence/actions/git-commit@d6560e817fb0e198d271e8c72f4a243d02188a8a # v0.0.4
         env:
           API_TOKEN_GITHUB: ${{ secrets.GH_TOKEN_GIT_COMMIT }}
         with:

.github/workflows/tests.yml

@@ -2,20 +2,32 @@ on: [push]
 
 name: tests
 
+permissions: {}
+
 jobs:
   install:
     name: Install dependencies
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/install-dependencies
 
   build:
     name: Run build
     runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
     needs: [install]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/install-dependencies
       - run: pnpm clean
       - run: pnpm build
@@ -25,12 +37,17 @@ jobs:
   tests:
     name: Run all tests
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
     needs: [build]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/install-dependencies
       - name: Install Foundry
-        uses: foundry-rs/foundry-toolchain@v1
+        uses: foundry-rs/foundry-toolchain@dba66c27052e63476d886f22216e119ba7e615bf # v1.9.2
         with:
           version: v1.5.0
       - name: Start Anvil in background

.github/workflows/zizmor.yml

@@ -0,0 +1,27 @@
+name: Workflow lint
+
+on:
+  pull_request:
+    paths: [".github/**"]
+  schedule:
+    - cron: "41 6 * * 1"
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: zizmor
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      security-events: write # SARIF upload to code scanning
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
+        with:
+          min-severity: medium
+          min-confidence: medium
+          advanced-security: true