fix: remediate security issues in workflows

Signed-off-by: John McCall <john@overturemaps.org>

Author: lowlydba

.github/workflows/check-python-code.yaml

@@ -1,7 +1,7 @@
 name: Check Python package code
 
 on:
-  pull_request_target:
+  pull_request:
     paths:
       - 'packages/**'
       - 'pyproject.toml'
@@ -16,12 +16,9 @@ on:
 jobs:
   check:
     runs-on: ubuntu-latest
-    if: github.event.pull_request.head.repo.full_name == github.repository
 
     steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
+      - uses: actions/checkout@v6
 
       - name: Install uv
         uses: astral-sh/setup-uv@v4

.github/workflows/check-python-package-versions.yaml

@@ -1,7 +1,7 @@
 name: Check Python package version numbers
 
 on:
-  pull_request_target:
+  pull_request:
     paths:
       - '**/pyproject.toml'
       - 'packages/**/__about__.py'
@@ -12,7 +12,6 @@ permissions:
 
 jobs:
   check:
-    if: github.event.pull_request.head.repo.full_name == github.repository
     uses: ./.github/workflows/reusable-check-python-package-versions.yaml
     with:
       before_commit: ${{ github.event.pull_request.base.sha }}

.github/workflows/publish-python-packages.yaml

@@ -6,6 +6,7 @@ on:
     paths:
       - '**/pyproject.toml'
       - 'packages/**/__about__.py'
+  workflow_dispatch:
     inputs:
       aws_iam_role_name:
         description: The name of the IAM role to assume for accessing CodeArtifact
@@ -64,16 +65,18 @@ jobs:
       - name: Get CodeArtifact publish URL
         id: get-code-artifact-params
         run: |
-          echo 'token<<EOF' >> $GITHUB_OUTPUT
-          ./.github/workflows/scripts/code-artifact.sh token \
-            505071440022 us-west-2 overture-pypi >> $GITHUB_OUTPUT
-          echo EOF >> $GITHUB_OUTPUT
-          echo 'publish_url<<EOF' >> $GITHUB_OUTPUT
-          ./.github/workflows/scripts/code-artifact.sh publish-url \
-            505071440022 us-west-2 overture-pypi overture >> $GITHUB_OUTPUT
-          echo EOF >> $GITHUB_OUTPUT
+          token=$(./.github/workflows/scripts/code-artifact.sh token \
+            505071440022 us-west-2 overture-pypi)
+          echo "::add-mask::${token}"
+          echo "token=${token}" >> $GITHUB_OUTPUT
+          publish_url=$(./.github/workflows/scripts/code-artifact.sh publish-url \
+            505071440022 us-west-2 overture-pypi overture)
+          echo "publish_url=${publish_url}" >> $GITHUB_OUTPUT
 
       - name: Publish package ${{ matrix.package }} version ${{ matrix.after }} to PyPI
+        env:
+          CA_TOKEN: ${{ steps.get-code-artifact-params.outputs.token }}
+          CA_PUBLISH_URL: ${{ steps.get-code-artifact-params.outputs.publish_url }}
         run: |
           package="${{ matrix.package }}"
           before="${{ matrix.before }}"
@@ -91,5 +94,5 @@ jobs:
             exit 1
           fi
           uv publish "$wheel" "$tarball" \
-             -t "${{ steps.get-code-artifact-params.outputs.token }}" \
-            --publish-url "${{ steps.get-code-artifact-params.outputs.publish_url }}"
+             -t "${CA_TOKEN}" \
+            --publish-url "${CA_PUBLISH_URL}"

.github/workflows/reusable-check-python-package-versions.yaml

@@ -62,17 +62,17 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y jq
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@v7
         with:
           version: latest
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
-          python-version: "3.10"
+          python-version-file: .python-version
 
       - name: Check out code before change
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ inputs.before_commit }}
 
@@ -123,20 +123,22 @@ jobs:
         id: get-code-artifact-index-url
         if: steps.save-changes.outputs.num_changed_packages > 0
         run: |
-          echo 'index_url<<EOF' >> $GITHUB_OUTPUT
-          ./.github/workflows/scripts/code-artifact.sh index-url \
+          index_url=$(./.github/workflows/scripts/code-artifact.sh index-url \
             "${{ inputs.aws_account_id }}" "${{ inputs.aws_region }}" \
-            "${{ inputs.domain }}" "${{ inputs.repository }}" >> $GITHUB_OUTPUT
-          echo EOF >> $GITHUB_OUTPUT
+            "${{ inputs.domain }}" "${{ inputs.repository }}")
+          echo "::add-mask::${index_url}"
+          echo "index_url=${index_url}" >> $GITHUB_OUTPUT
 
       - name: Fail if any of the new versions already exist in the repo
         if: steps.save-changes.outputs.num_changed_packages > 0
+        env:
+          INDEX_URL: ${{ steps.get-code-artifact-index-url.outputs.index_url }}
         run: |
           jq -c '.[]' /tmp/package-version-diff.json | while read -r entry; do
             package=$(echo "$entry" | jq -r '.package')
             after=$(echo "$entry" | jq -r '.after')
             exit_code=0
-            output=$(uv run pip download "${package}==${after}" --index-url "${{ steps.get-code-artifact-index-url.outputs.index_url }}" --no-deps -d /tmp --quiet 2>&1) || exit_code=$?
+            output=$(uv run pip download "${package}==${after}" --index-url "${INDEX_URL}" --no-deps -d /tmp --quiet 2>&1) || exit_code=$?
             if [[ $exit_code -eq 0 || (
               "${output,,}" != *"could not find a version"* &&
               "${output,,}" != *"no matching distributions"*