From d4a5bf5fe6c7169bd622d782110474b452bde7c3 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Sun, 19 Jul 2026 22:30:15 +0100
Subject: [PATCH] =?UTF-8?q?ci:=20harden=20workflows=20=E2=80=94=20pin=20ac?=
 =?UTF-8?q?tions=20to=20SHAs,=20drop=20inlined=20SSH=20key,=20least-privil?=
 =?UTF-8?q?ege?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pin mutable third-party actions to full commit SHAs (amannn/action-
semantic-pull-request, dtolnay/rust-toolchain, dorny/paths-filter,
pnpm/action-setup) so a repointed tag can't run with CI privileges;
Dependabot's github-actions ecosystem can bump them. Remove the inlined
SSH private key from _release.reusable.yml (buggy and redundant with
actions/checkout's ssh-key:). Scope the release.yml check-labels job to
contents: read.

Closes #560

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BT6fVBZrmExXZj7vQ29881
---
 .github/workflows/_ci-detect-changes.reusable.yml    | 2 +-
 .github/workflows/_ci-integration.reusable.yml       | 2 +-
 .github/workflows/_release.reusable.yml              | 5 -----
 .github/workflows/actions/setup-workspace/action.yml | 2 +-
 .github/workflows/examples-validate.yml              | 2 +-
 .github/workflows/pr-title.yml                       | 2 +-
 .github/workflows/release.yml                        | 3 +++
 7 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/_ci-detect-changes.reusable.yml b/.github/workflows/_ci-detect-changes.reusable.yml
index 4a2daf6b..fbdb4047 100644
--- a/.github/workflows/_ci-detect-changes.reusable.yml
+++ b/.github/workflows/_ci-detect-changes.reusable.yml
@@ -58,7 +58,7 @@ jobs:
           fetch-depth: 0
 
       - name: Detect changed files
-        uses: dorny/paths-filter@v4
+        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4
         id: changes
         with:
           filters: |
diff --git a/.github/workflows/_ci-integration.reusable.yml b/.github/workflows/_ci-integration.reusable.yml
index fb4d033a..95599a41 100644
--- a/.github/workflows/_ci-integration.reusable.yml
+++ b/.github/workflows/_ci-integration.reusable.yml
@@ -36,7 +36,7 @@ jobs:
 
       # Provides cargo for the Cargo.lock self-version sync integration test (#496). The test is
       # skipped when cargo is absent, so this toolchain is what makes it actually run in CI.
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
 
       - name: Run integration tests
         run: pnpm --filter @releasekit/integration-tests test
diff --git a/.github/workflows/_release.reusable.yml b/.github/workflows/_release.reusable.yml
index 25ec60e7..6a1b74db 100644
--- a/.github/workflows/_release.reusable.yml
+++ b/.github/workflows/_release.reusable.yml
@@ -79,11 +79,6 @@ jobs:
       - name: Build packages
         run: pnpm build
 
-      - name: Configure git SSH for tag pushes
-        if: ${{ !inputs.dry_run }}
-        run: |
-          git config --global core.sshCommand "ssh -i ${{ secrets.ssh_key }} -o StrictHostKeyChecking=no"
-
       - name: Run releasekit
         id: release
         if: inputs.standing_pr_number == ''
diff --git a/.github/workflows/actions/setup-workspace/action.yml b/.github/workflows/actions/setup-workspace/action.yml
index 8384f85a..1c3ebd78 100644
--- a/.github/workflows/actions/setup-workspace/action.yml
+++ b/.github/workflows/actions/setup-workspace/action.yml
@@ -10,7 +10,7 @@ runs:
   using: composite
   steps:
     - name: Setup pnpm
-      uses: pnpm/action-setup@v5
+      uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
 
     - name: Setup Node.js
       uses: actions/setup-node@v6
diff --git a/.github/workflows/examples-validate.yml b/.github/workflows/examples-validate.yml
index a3888224..0a581695 100644
--- a/.github/workflows/examples-validate.yml
+++ b/.github/workflows/examples-validate.yml
@@ -95,7 +95,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
 
       - uses: actions/setup-node@v6
         with:
diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml
index d8f330c8..77411a6e 100644
--- a/.github/workflows/pr-title.yml
+++ b/.github/workflows/pr-title.yml
@@ -14,7 +14,7 @@ jobs:
     name: Validate PR Title
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@v6
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6
         env:
           GITHUB_TOKEN: ${{ github.token }}
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6f509380..3eea6e2e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -69,6 +69,9 @@ jobs:
   check-labels:
     name: Check Release Labels
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read # reads the merged PR + its labels via `gh api repos/.../commits/.../pulls`
     if: github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push'
     outputs:
       should_release: ${{ steps.check.outputs.should_release }}