Improve the security of GitHub Action workflows (#4421)

bouweandela · web-flow · commit 881373420eb4 · 2026-05-27T09:27:36.000+02:00
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -12,6 +12,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     labels:
       - dependencies
       - github_actions
diff --git a/.github/workflows/check-rtw.yml b/.github/workflows/check-rtw.yml
@@ -1,6 +1,8 @@
 # This workflow performs various validation steps for Cylc and Rose.
 name: Check Recipe Test Workflow (RTW)
 
+permissions: {}
+
 # Controls when the action will run
 on:
   # Triggers the workflow on push events
@@ -36,10 +38,12 @@ jobs:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job
       # can access it
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Cylc
-        uses: cylc/setup-cylc@v1
+        uses: cylc/setup-cylc@99ce72c7841aa3f222420d2df16fa31a31f76fde # v1.0.1
         with:
           cylc_rose: true
 
diff --git a/.github/workflows/check_links.yml b/.github/workflows/check_links.yml
@@ -1,5 +1,7 @@
 name: Check Links for Documentation
 
+permissions: {}
+
 on:
   # push:
   #   branches:
@@ -15,11 +17,13 @@ jobs:
     permissions:
       issues: write # Required for peter-evans/create-issue-from-file
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Link Checker
         id: lychee
-        uses: lycheeverse/lychee-action@v2
+        uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411  # v2.8.0
 
         with:
           #  This token is included to avoid github.com requests rate limiting
@@ -35,7 +39,7 @@ jobs:
 
       - name: Create Issue From File
         if: steps.lychee.outputs.exit_code != 0
-        uses: peter-evans/create-issue-from-file@v6
+        uses: peter-evans/create-issue-from-file@fca9117c27cdc29c6c4db3b86c48e4115a786710 # v6.0.0
         with:
           title: "🔗 Link Checker Report - ${{ env.REPORT_DATE }}"
           content-filepath: ./lychee/out.md
diff --git a/.github/workflows/check_links_in_pr.yml b/.github/workflows/check_links_in_pr.yml
@@ -1,4 +1,7 @@
 name: Link Checker for Pull requests
+
+permissions: {}
+
 on:
   pull_request:
     branches:
@@ -9,10 +12,12 @@ jobs:
     outputs:
       files: ${{ steps.changed-doc-files.outputs.all_changed_files }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Get changed doc files
         id: changed-doc-files
-        uses: tj-actions/changed-files@v47
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
         with:
           # Avoid using single or double quotes for multiline patterns
           files: |
@@ -28,12 +33,13 @@ jobs:
         file: ${{ fromJSON(needs.changedFiles.outputs.files) }}
       fail-fast: false
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 2
+          persist-credentials: false
       - name: Link Checker for changed files
         id: lychee
-        uses: lycheeverse/lychee-action@v2
+        uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411  # v2.8.0
         with:
           #  This token is included to avoid github.com requests rate limiting
           token: ${{ secrets.TOKEN_GITHUB }}
diff --git a/.github/workflows/citation_file_validator.yml b/.github/workflows/citation_file_validator.yml
@@ -3,6 +3,8 @@
 
 name: CFF File Validator
 
+permissions: {}
+
 on:
   push:
     paths:
@@ -17,9 +19,11 @@ jobs:
     if: github.event_name != 'schedule' || github.repository == 'ESMValGroup/ESMValTool' # avoid scheduled GHAs in forks
     steps:
       - name: Check out a copy of the repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Check whether the citation metadata from CITATION.cff is valid
-        uses: citation-file-format/cffconvert-github-action@2.0.0
+        uses: citation-file-format/cffconvert-github-action@4cf11baa70a673bfdf9dad0acc7ee33b3f4b6084 # 2.0.0
         with:
           args: "--validate"
diff --git a/.github/workflows/cron_esmvalbot_test.yml b/.github/workflows/cron_esmvalbot_test.yml
@@ -1,5 +1,9 @@
 name: Run Esmvalbot Test
 
+permissions:
+  contents: write
+  pull-requests: write
+
 on:
   # push:
   #   branches:
@@ -18,9 +22,10 @@ jobs:
     runs-on: 'ubuntu-latest'
     if: github.repository == 'ESMValGroup/ESMValTool'  # avoid GAs in forks
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Create empty commit on branch
         run: |
           git config user.name 'Valeriu Predoi'
@@ -30,7 +35,7 @@ jobs:
       # as comment in the PR
       # see https://github.com/marketplace/actions/create-pull-request
       - name: Create Auto PR
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: empty message
diff --git a/.github/workflows/install-from-conda.yml b/.github/workflows/install-from-conda.yml
@@ -1,6 +1,8 @@
 ---
 name: Install from Conda
 
+permissions: {}
+
 # runs on a push on main and at the end of every day
 on:
   push:
diff --git a/.github/workflows/pypi-build-and-deploy.yml b/.github/workflows/pypi-build-and-deploy.yml
@@ -1,6 +1,8 @@
 # Workflow from https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/
 name: Publish Python 🐍 distribution 📦 to PyPI and TestPyPI
 
+permissions: {}
+
 on:
   release:
     types: [published]
@@ -16,12 +18,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           persist-credentials: false
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.x"
       - name: Install pypa/build
@@ -33,7 +35,7 @@ jobs:
       - name: Build a binary wheel and a source tarball
         run: python3 -m build
       - name: Store the distribution packages
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: python-package-distributions
           path: dist/
@@ -53,9 +55,9 @@ jobs:
 
     steps:
       - name: Download all the dists
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: python-package-distributions
           path: dist/
       - name: Publish distribution 📦 to PyPI
-        uses: pypa/gh-action-pypi-publish@v1.14.0
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
diff --git a/.github/workflows/run-tests-monitor.yml b/.github/workflows/run-tests-monitor.yml
@@ -1,5 +1,8 @@
 ---
 name: Monitor Tests
+
+permissions: {}
+
 on:
   push:
     branches:
@@ -24,14 +27,19 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest]
-        environment: [test-py312, test-py313]
+        os:
+          - ubuntu-latest
+          - macos-latest
+        environment:
+          - test-py312
+          - test-py313
     name: ${{ matrix.os }} ${{ matrix.environment }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-      - uses: prefix-dev/setup-pixi@v0.9.5
+          persist-credentials: false
+      - uses: prefix-dev/setup-pixi@a0af7a228712d6121d37aba47adf55c1332c9c2e  # v0.9.4
         with:
           frozen: true
           environments: ${{ matrix.environment }}
@@ -43,7 +51,7 @@ jobs:
         run: python tests/parse_pymon.py
       - name: Upload artifacts
         if: ${{ always() }} # upload artifacts even if fail
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: Test_reports_${{ matrix.os }}_${{ matrix.environment }}
           path: test-reports
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
@@ -1,5 +1,7 @@
 name: Close stale issues and pull requests
 
+permissions: {}
+
 on:
   schedule:
     # Run once a day
@@ -10,7 +12,7 @@ jobs:
     if: "github.repository == 'ESMValGroup/ESMValTool'"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
         with:
           days-before-issue-stale: 1080
           days-before-pr-stale: 360
diff --git a/.github/workflows/test-development.yml b/.github/workflows/test-development.yml
@@ -7,6 +7,8 @@
 ---
 name: Test in Full Development Mode
 
+permissions: {}
+
 # runs on a push on main and at the end of every day
 on:
   push:
@@ -26,10 +28,11 @@ jobs:
     if: github.repository == 'ESMValGroup/ESMValTool' # avoid GAs in forks
     name: Linux Python ${{ matrix.python-version }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-      - uses: prefix-dev/setup-pixi@v0.9.5
+          persist-credentials: false
+      - uses: prefix-dev/setup-pixi@a0af7a228712d6121d37aba47adf55c1332c9c2e  # v0.9.4
         with:
           frozen: true
           environments: esmvalcore-dev
@@ -39,7 +42,7 @@ jobs:
         run: pytest -n 2 -m "not installation"
       - name: Upload artifacts
         if: ${{ always() }} # upload artifacts even if fail
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: Development_installation_test_reports
           path: test-reports
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -1,6 +1,8 @@
 ---
 name: Test
 
+permissions: {}
+
 # runs on a push on main and at the end of every day
 on:
   push:
@@ -21,14 +23,19 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest]
-        environment: [test-py312, test-py313]
+        os:
+          - ubuntu-latest
+          - macos-latest
+        environment:
+          - test-py312
+          - test-py313
     name: ${{ matrix.os }} ${{ matrix.environment }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-      - uses: prefix-dev/setup-pixi@v0.9.5
+          persist-credentials: false
+      - uses: prefix-dev/setup-pixi@a0af7a228712d6121d37aba47adf55c1332c9c2e  # v0.9.4
         with:
           frozen: true
           environments: ${{ matrix.environment }}
@@ -40,7 +47,7 @@ jobs:
         run: pytest -n 2 -m "not installation"
       - name: Upload artifacts
         if: ${{ always() }} # upload artifacts even if fail
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: Test_reports_${{ matrix.os }}_${{ matrix.environment }}
           path: test-reports
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
@@ -0,0 +1,23 @@
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+        with:
+          advanced-security: false
