Harden GitHub Actions workflows

* Pins all 3rd party actions to digests, using digests we already use in other repositories.
* Drops permissions in all workflows and explicitly declares them at the job-level where needed.
* Updates release workflow to create releases as draft first, and only publish them after all assets have been uploaded. This enables us to use immutable GitHub releases.
* Removes unneeded workflows.

Signed-off-by: nscuro <nscuro@protonmail.com>

Author: nscuro

.github/workflows/_meta-build.yaml

@@ -1,3 +1,5 @@
+permissions: {}
+
 on:
   workflow_call:
     inputs:
@@ -27,10 +29,10 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
 
       - name: Set up NodeJs
-        uses: actions/setup-node@v6.3.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # tag=v6.3.0
         with:
           node-version: '20'
           cache: 'npm'
@@ -43,7 +45,7 @@ jobs:
           npm run build --if-present
 
       - name: Upload Artifacts
-        uses: actions/upload-artifact@v7.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # tag=v7.0.0
         with:
           name: assembled-frontend
           path: |-
@@ -57,24 +59,24 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
 
       - name: Download Artifacts
-        uses: actions/download-artifact@v8.0.0
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # tag=v8.0.0
         with:
           name: assembled-frontend
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4.0.0
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # tag=v3.7.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4.0.0
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # tag=v4.0.0
         id: buildx
         with:
           install: true
 
       - name: Login to Docker.io
-        uses: docker/login-action@v4.0.0
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # tag=v4.0.0
         if: ${{ inputs.publish-container }}
         with:
           registry: docker.io
@@ -99,7 +101,7 @@ jobs:
           echo "tags=${TAGS}" >> $GITHUB_OUTPUT
 
       - name: Build multi-arch Container Image
-        uses: docker/build-push-action@v7.0.0
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # tag=v7.0.0
         with:
           tags: ${{ steps.tags.outputs.tags }}
           build-args: |-
@@ -109,4 +111,3 @@ jobs:
           push: ${{ inputs.publish-container }}
           context: .
           file: docker/Dockerfile.alpine
-

.github/workflows/ci-build.yaml

@@ -11,6 +11,8 @@ on:
       - 'feature-**' # Feature branches
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   call-build:
     uses: ./.github/workflows/_meta-build.yaml

.github/workflows/ci-publish.yaml

@@ -3,9 +3,11 @@ name: Publish CI
 on:
   release:
     types:
-      - released
+      - created
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   read-version:
     runs-on: ubuntu-latest
@@ -20,7 +22,7 @@ jobs:
           fi
 
       - name: Checkout Repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
 
       - name: Parse Version from package.json
         id: parse
@@ -42,15 +44,17 @@ jobs:
 
   update-github-release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # Required to edit release.
     needs:
       - read-version
       - call-build
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
 
       - name: Download Artifacts
-        uses: actions/download-artifact@v8.0.0
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # tag=v8.0.0
         with:
           name: assembled-frontend
 
@@ -67,7 +71,7 @@ jobs:
 
       - name: Update Release
         env:
-          GITHUB_TOKEN: ${{ secrets.BOT_RELEASE_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |-
           cat << EOF >> .github/default-release-notes.md
           \`\`\`text
@@ -86,3 +90,10 @@ jobs:
             frontend-dist.zip \
             checksums.txt \
             bom.xml bom.json
+
+      - name: Publish Release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |-
+          gh release edit ${{ needs.read-version.outputs.version }} \
+            --draft=false

.github/workflows/ci-release.yaml

@@ -16,15 +16,19 @@ on:
           - premajor
           - prerelease
 
+permissions: {}
+
 jobs:
   prepare-release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # Required to create commits.
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
 
       - name: Set up NodeJs
-        uses: actions/setup-node@v6.3.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # tag=v6.3.0
         with:
           node-version: '20'
           cache: 'npm'
@@ -52,4 +56,5 @@ jobs:
           gh release create "${VERSION}" ${GH_OPTS} \
             --target "${{ github.ref_name }}" \
             --title "${VERSION}" \
+            --draft \
             --generate-notes

.github/workflows/codeql-analysis.yaml

@@ -9,19 +9,18 @@ on:
       - 'master' # Default branch
       - 'feature-**' # Feature branches
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   check:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
 
       - name: Set up NodeJs
-        uses: actions/setup-node@v6.3.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # tag=v6.3.0
         with:
           node-version: '20'
           cache: 'npm'

.github/workflows/dependency-review.yaml

@@ -9,19 +9,18 @@ on:
       - 'master' # Default branch
       - 'feature-**' # Feature branches
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   lint:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
 
       - name: Set up NodeJs
-        uses: actions/setup-node@v6.3.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # tag=v6.3.0
         with:
           node-version: '20'
           cache: 'npm'