chore(ci): harden ci + harden default workflow templates + pin actions on hash (#11676)

* lower permissions packages codeql

* scope permissions, test.yml and test-isolate.yml

* set default permissions

* restrict permissions: nix.yml

* bump deps

* pin deps: test.yml

* avoid any caching for releases, improve string handling

* avoid writing to GITHUB_ENV

* harden nix.yml

* pin deps nextest, harden

* pin deps

* restore matrix.flags

* add dependabot

* pin dep

* harden default workflow template

* unpin setup-node, nit

* rescope to minimal permissions

* fix workflow

* grant docker-publish workflow the permissions it requires

* do not cache in docker-publish

* use printf in docker-publish, revert shell defaulting in release.yml

Author: zerosnacks

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/benchmarks.yml

@@ -1,5 +1,7 @@
 name: Foundry Benchmarks
 
+permissions: {}
+
 on:
   workflow_dispatch:
     inputs:
@@ -18,10 +20,6 @@ on:
         type: string
         default: "ithacaxyz/account:v0.3.2,Vectorized/solady:v0.1.22"
 
-permissions:
-  contents: write
-  pull-requests: write
-
 env:
   ITHACAXYZ_ACCOUNT: "ithacaxyz/account:v0.3.2"
   VECTORIZED_SOLADY: "Vectorized/solady:v0.1.22"
@@ -31,36 +29,43 @@ jobs:
   run-benchmarks:
     name: Run All Benchmarks
     runs-on: foundry-runner
+    permissions:
+      contents: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Install build dependencies
         run: |
           sudo apt-get update
           sudo apt-get install -y build-essential pkg-config
 
       - name: Setup Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
+        with:
+          toolchain: stable
 
       - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2
         with:
           workspaces: |
             ./
 
       - name: Setup Foundry
         env:
           FOUNDRY_DIR: ${{ github.workspace }}/.foundry
+          GITHUB_WORKSPACE: ${{ github.workspace }}
         run: |
           ./.github/scripts/setup-foundryup.sh
-          echo "${{ github.workspace }}/.foundry/bin" >> $GITHUB_PATH
+          printf '%s\n' "$GITHUB_WORKSPACE/.foundry/bin" >> "$GITHUB_PATH"
 
       - name: Build benchmark binary
         run: cargo build --release --bin foundry-bench
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: "24"
 
@@ -151,9 +156,14 @@ jobs:
     name: Publish Results
     needs: run-benchmarks
     runs-on: foundry-runner
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Download benchmark results
         uses: actions/download-artifact@v4

.github/workflows/bump-forge-std.yml

@@ -2,21 +2,28 @@
 
 name: bump-forge-std
 
+permissions: {}
+
 on:
   schedule:
-    - cron: "0 0 * * *"
-  workflow_dispatch:
+    - cron: "0 0 * * *" # Run daily at midnight UTC
+  workflow_dispatch: # Needed so we can run it manually
 
 jobs:
   update-tag:
     name: update forge-std tag
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - name: Fetch and update forge-std tag
         run: curl 'https://api.github.com/repos/foundry-rs/forge-std/tags' | jq '.[0].commit.sha' -jr > testdata/forge-std-rev
       - name: Create pull request
-        uses: peter-evans/create-pull-request@v5
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7
         with:
           commit-message: "chore: bump forge-std version used for tests"
           title: "chore(tests): bump forge-std version"

.github/workflows/codeql.yml

@@ -1,5 +1,7 @@
 name: CodeQL
 
+permissions: {}
+
 on:
   push:
     branches: ["master"]
@@ -18,10 +20,9 @@ jobs:
     name: Analyze (${{ matrix.language }})
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       security-events: write
-      packages: read
       actions: read
-      contents: read
 
     strategy:
       fail-fast: false
@@ -33,6 +34,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3

.github/workflows/dependencies.yml

@@ -2,19 +2,18 @@
 
 name: dependencies
 
+permissions: {}
+
 on:
   schedule:
-    # Run weekly
-    - cron: "0 0 * * SUN"
-  workflow_dispatch:
-# Needed so we can run it manually
-
-permissions:
-  contents: write
-  pull-requests: write
+    - cron: "0 0 * * SUN" # Run weekly on Sundays at midnight UTC
+  workflow_dispatch: # Needed so we can run it manually
 
 jobs:
   update:
-    uses: ithacaxyz/ci/.github/workflows/cargo-update-pr.yml@main
+    uses: ithacaxyz/ci/.github/workflows/cargo-update-pr.yml@9c8d0dc20e7ad02455d3fdab2378a05f29907630 # main
+    permissions:
+      contents: write
+      pull-requests: write
     secrets:
       token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/docker-publish.yml

@@ -1,5 +1,7 @@
 name: docker
 
+permissions: {}
+
 on:
   # Trigger without any parameters a proactive rebuild
   workflow_dispatch: {}
@@ -19,16 +21,17 @@ jobs:
     name: build and push
     runs-on: Linux-22.04
     permissions:
+      contents: read
       id-token: write
       packages: write
-      contents: read
     timeout-minutes: 120
     steps:
       - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
         with:
-          cache-on-failure: true
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
+        with:
+          toolchain: stable
       - name: Install gcc aarch64
         id: aarch_64_setup
         run: |
@@ -38,7 +41,7 @@ jobs:
       - name: Login into registry ${{ env.REGISTRY }}
         # Ensure this doesn't trigger on PR's
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v2
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -48,7 +51,7 @@ jobs:
       # https://github.com/docker/metadata-action
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
 
@@ -59,22 +62,22 @@ jobs:
       - name: Finalize Docker Metadata
         id: docker_tagging
         run: |
-          if [[ "${{ github.event_name }}" == 'schedule' ]]; then
-            echo "cron trigger, assigning nightly tag"
-            echo "docker_tags=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:nightly,${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:nightly-${GITHUB_SHA}" >> $GITHUB_OUTPUT
-          elif [[ "${GITHUB_REF##*/}" == "main" ]] || [[ ${GITHUB_REF##*/} == "master" ]]; then
-            echo "manual trigger from master/main branch, assigning latest tag"
-            echo "docker_tags=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${GITHUB_REF##*/},${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest" >> $GITHUB_OUTPUT
+          if [[ "${{ github.event_name }}" == "schedule" ]]; then
+            printf "cron trigger, assigning nightly tag\n"
+            printf "docker_tags=%s/%s:nightly,%s/%s:nightly-%s\n" "${{ env.REGISTRY }}" "${{ env.IMAGE_NAME }}" "${{ env.REGISTRY }}" "${{ env.IMAGE_NAME }}" "$GITHUB_SHA" >> "$GITHUB_OUTPUT"
+          elif [[ "${GITHUB_REF##*/}" == "main" ]] || [[ "${GITHUB_REF##*/}" == "master" ]]; then
+            printf "manual trigger from master/main branch, assigning latest tag\n"
+            printf "docker_tags=%s/%s:%s,%s/%s:latest\n" "${{ env.REGISTRY }}" "${{ env.IMAGE_NAME }}" "${GITHUB_REF##*/}" "${{ env.REGISTRY }}" "${{ env.IMAGE_NAME }}" >> "$GITHUB_OUTPUT"
           else
-            echo "Neither scheduled nor manual release from main branch. Just tagging as branch name"
-            echo "docker_tags=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${GITHUB_REF##*/}" >> $GITHUB_OUTPUT
+            printf "Neither scheduled nor manual release from main branch. Just tagging as branch name\n"
+            printf "docker_tags=%s/%s:%s\n" "${{ env.REGISTRY }}" "${{ env.IMAGE_NAME }}" "${GITHUB_REF##*/}" >> "$GITHUB_OUTPUT"
           fi
 
       # Log docker metadata to explicitly know what is being pushed
       - name: Inspect Docker Metadata
         run: |
-          echo "TAGS -> ${{ steps.docker_tagging.outputs.docker_tags }}"
-          echo "LABELS -> ${{ steps.meta.outputs.labels }}"
+          printf "TAGS -> %s\n" "${{ steps.docker_tagging.outputs.docker_tags }}"
+          printf "LABELS -> %s\n" "${{ steps.meta.outputs.labels }}"
 
       - name: Build and push foundry image
         run: make DOCKER_IMAGE_NAME=${{ steps.docker_tagging.outputs.docker_tags }} CARGO_TAG_NAME=${{ inputs.tag_name }} PROFILE=maxperf docker-build-push

.github/workflows/nextest.yml

@@ -2,6 +2,8 @@
 
 name: nextest
 
+permissions: {}
+
 on:
   workflow_call:
     inputs:
@@ -21,27 +23,34 @@ jobs:
   matrices:
     name: build matrices
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       test-matrix: ${{ steps.gen.outputs.test-matrix }}
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/setup-python@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.11"
       - name: Generate matrices
         id: gen
         env:
           EVENT_NAME: ${{ github.event_name }}
           PROFILE: ${{ inputs.profile }}
+        shell: bash
         run: |
           output=$(python3 .github/scripts/matrices.py)
-          echo "::debug::test-matrix=$output"
-          echo "test-matrix=$output" >> $GITHUB_OUTPUT
+          printf '::debug::test-matrix=%s\n' "$output"
+          printf 'test-matrix=%s\n' "$output" >> "$GITHUB_OUTPUT"
 
   test:
     name: test ${{ matrix.name }}
     runs-on: ${{ matrix.runner_label }}
     timeout-minutes: 60
+    permissions:
+      contents: read
     needs: matrices
     strategy:
       fail-fast: false
@@ -50,24 +59,29 @@ jobs:
       CARGO_PROFILE_DEV_DEBUG: 0
     steps:
       - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@stable
         with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
+        with:
+          toolchain: stable
           target: ${{ matrix.target }}
-      - uses: taiki-e/install-action@nextest
+      - uses: taiki-e/install-action@e5f8d33e7166e0491b2ab4ff0567cc6cd6772737 # v2
+        with:
+          tool: nextest
 
       # External tests dependencies
       - name: Setup Node.js
         if: contains(matrix.name, 'external')
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: 24
       - name: Install Bun
         if: contains(matrix.name, 'external') && !contains(matrix.runner_label, 'windows')
-        uses: oven-sh/setup-bun@v1
+        uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2
         with:
           bun-version: latest
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: 3.11
       - name: Install Vyper
@@ -81,7 +95,7 @@ jobs:
             ~/.foundry/cache
             ~/.config/.foundry/cache
           key: rpc-cache-${{ hashFiles('crates/forge/tests/rpc-cache-keyfile') }}
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2
         with:
           cache-on-failure: true
       - name: Setup Git config

.github/workflows/nix.yml

@@ -1,11 +1,11 @@
 name: nix
 
+permissions: {}
+
 on:
   schedule:
-    # Run weekly
-    - cron: "0 0 * * SUN"
-  workflow_dispatch:
-# Needed so we can run it manually
+    - cron: "0 0 * * SUN" # Run weekly on Sundays at midnight UTC
+  workflow_dispatch: # Needed so we can run it manually
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -15,10 +15,15 @@ jobs:
   # Opens a PR with an updated flake.lock file
   update:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
-      - uses: DeterminateSystems/determinate-nix-action@v3
+      - uses: DeterminateSystems/determinate-nix-action@dbda91f6efef3ee627f56175120aa9543687d830 # v3
       - uses: actions/checkout@v5
-      - uses: DeterminateSystems/update-flake-lock@main
+        with:
+          persist-credentials: false
+      - uses: DeterminateSystems/update-flake-lock@4d443398067153ddd6191a9d9c89533f9a100c26 # main
         with:
           pr-title: "Update flake.lock"
           pr-labels: |
@@ -30,9 +35,13 @@ jobs:
       matrix:
         runs-on: [ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.runs-on }}
+    permissions:
+      contents: read
     steps:
-      - uses: DeterminateSystems/determinate-nix-action@v3
+      - uses: DeterminateSystems/determinate-nix-action@dbda91f6efef3ee627f56175120aa9543687d830 # v3
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Update flake.lock
         run: nix flake update