ci: split preview-publish job, SHA-pin third-party actions, narrow dependabot auto-merge to non-production deps

Vulthil · Vulthil · commit d6ecbc9c531c · 2026-07-03T22:52:20.000+02:00
diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
@@ -34,7 +34,7 @@ jobs:
           fetch-depth: 0
 
       - name: Create backport PRs
-        uses: korthout/backport-action@v4
+        uses: korthout/backport-action@2e830a1d0b8269505846ddd407a70876913ad1f8 # v4
         with:
           # AUTOMATION_TOKEN (a PAT/App token) lets the required `build` check
           # run on the created PR; pushes made with the default GITHUB_TOKEN do
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -15,11 +15,11 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      packages: write
     steps:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: actions/setup-dotnet@v5
 
@@ -56,14 +56,16 @@ jobs:
           name: coverage-report
           path: ./CoverageReport
 
+      # Uses gh api directly instead of a third-party gist-deploy action -- one
+      # less individual-maintainer action holding a token in its supply chain.
       - name: Publish coverage badge to Gist
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: exuanbo/actions-deploy-gist@v1
-        with:
-          token: ${{ secrets.GIST_TOKEN }}
-          gist_id: 2852f1400e27493b185559c76b38e9b7
-          file_path: ./CoverageReport/badge_combined.svg
-          file_type: binary
+        env:
+          GH_TOKEN: ${{ secrets.GIST_TOKEN }}
+        run: |
+          jq -n --rawfile content ./CoverageReport/badge_combined.svg \
+            '{files: {"badge_combined.svg": {content: $content}}}' \
+          | gh api --method PATCH /gists/2852f1400e27493b185559c76b38e9b7 --input -
 
       # Preview (prerelease) packages. main is not a public release ref
       # (version.json), so every CI build carries a prerelease suffix. PRs pack
@@ -83,8 +85,41 @@ jobs:
           name: nuget-packages
           path: ./artifacts/*
 
-      - name: Publish preview to GitHub Packages
+      # Hands packages to the publish-preview job below, which carries
+      # packages: write instead of this job -- keeps that credential out of the
+      # job that runs untrusted PR code (dotnet build/test run arbitrary MSBuild
+      # targets from the PR).
+      - name: Upload preview packages
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        uses: actions/upload-artifact@v7
+        with:
+          name: preview-packages
+          path: ./artifacts/*
+
+  # Split from `build` so the packages: write token is never present while
+  # building/testing PR code. Only runs for pushes to main, never for PRs
+  # (including same-repo ones), so a compromised dependency can't use this
+  # token from its own PR build.
+  publish-preview:
+    needs: build
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-dotnet@v5
+
+      - uses: actions/download-artifact@v7
+        with:
+          name: preview-packages
+          path: ./artifacts
+
+      - name: Publish preview to GitHub Packages
         run: |
           dotnet nuget push "./artifacts/*.nupkg" \
             --api-key ${{ secrets.GITHUB_TOKEN }} \
diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
@@ -33,7 +33,7 @@ jobs:
 
       - name: Run Claude Code Review
         id: claude-review
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@01872ccc02bf66740207fb338a783ce028216758 # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
@@ -32,7 +32,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@01872ccc02bf66740207fb338a783ce028216758 # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 
diff --git a/.github/workflows/dependabot-approve-and-automerge.yml b/.github/workflows/dependabot-approve-and-automerge.yml
@@ -1,4 +1,14 @@
 name: Dependabot Auto-Approve and Auto-Merge
+
+# Auto-merges Dependabot patch/minor updates, narrowed by blast radius:
+# github-actions bumps (CI-only, and SHA-pinned per T10) and NuGet packages
+# NOT referenced by any shipped src/ project still auto-merge once CI (build)
+# passes. NuGet's own dependency-type classification has no test-project
+# detection (every NuGet requirement reports as "direct:production" -- see
+# Dependabot::Dependency.register_production_check in dependabot-core), so the
+# src/ check below is done directly against src/**/*.csproj instead of trusted
+# from Dependabot metadata. Majors, dotnet-sdk bumps, docker bumps, and any
+# NuGet package referenced by src/ always require a human review and merge.
 on: pull_request
 
 permissions:
@@ -12,20 +22,54 @@ jobs:
     steps:
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v3.1.0
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
+
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
       # Only auto-approve/merge patch and minor updates. A major bump can carry
       # breaking changes that still compile and pass tests, then ship to consumers
-      # unnoticed -- leave majors for a human to review and merge.
-      - name: Approve a PR
+      # unnoticed -- leave majors for a human to review and merge. Within
+      # patch/minor, narrow further by dependency risk (see file header).
+      - name: Decide auto-merge eligibility
+        id: eligibility
         if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        env:
+          ECOSYSTEM: ${{ steps.metadata.outputs.package-ecosystem }}
+          UPDATED_DEPENDENCIES_JSON: ${{ steps.metadata.outputs.updated-dependencies-json }}
+        run: |
+          case "$ECOSYSTEM" in
+            github_actions)
+              echo "eligible=true" >> "$GITHUB_OUTPUT"
+              ;;
+            nuget)
+              production_found=false
+              while IFS= read -r name; do
+                [ -z "$name" ] && continue
+                if grep -rqiF "Include=\"$name\"" src/ --include="*.csproj"; then
+                  production_found=true
+                  echo "::notice::src/ references $name -- not auto-merging"
+                fi
+              done < <(echo "$UPDATED_DEPENDENCIES_JSON" | jq -r '.[].dependencyName' | sort -u)
+              echo "eligible=$([ "$production_found" = true ] && echo false || echo true)" >> "$GITHUB_OUTPUT"
+              ;;
+            *)
+              echo "eligible=false" >> "$GITHUB_OUTPUT"
+              echo "::notice::Not auto-merging -- $ECOSYSTEM ecosystem requires human review"
+              ;;
+          esac
+
+      - name: Approve a PR
+        if: steps.eligibility.outputs.eligible == 'true'
         run: gh pr review --approve "$PR_URL"
         env:
           PR_URL: ${{github.event.pull_request.html_url}}
           GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
       - name: Enable auto-merge for Dependabot PRs
-        if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        if: steps.eligibility.outputs.eligible == 'true'
         run: gh pr merge --auto --merge "$PR_URL"
         env:
           PR_URL: ${{github.event.pull_request.html_url}}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -65,25 +65,25 @@ jobs:
 
       - name: Generate release notes
         id: changelog
-        uses: orhun/git-cliff-action@v4
+        uses: orhun/git-cliff-action@f50e11560dce63f7c33227798f90b924471a88b5 # v4
         with:
           config: cliff.toml
           args: --unreleased --tag v${{ steps.version.outputs.version }} --strip header
         env:
           OUTPUT: CHANGES.md
 
+      # Uses gh release create directly instead of a third-party release action
+      # -- one less individual-maintainer action holding contents: write.
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v3
-        with:
-          name: v${{ steps.version.outputs.version }}
-          tag_name: v${{ steps.version.outputs.version }}
-          target_commitish: ${{ github.sha }}
-          body_path: CHANGES.md
-          files: |
-            ./artifacts/*.nupkg
-            ./artifacts/*.snupkg
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "v${{ steps.version.outputs.version }}" \
+            ./artifacts/*.nupkg ./artifacts/*.snupkg \
+            --repo "${{ github.repository }}" \
+            --title "v${{ steps.version.outputs.version }}" \
+            --notes-file CHANGES.md \
+            --target "${{ github.sha }}"
 
       - name: Publish to GitHub Packages
         run: |
@@ -99,7 +99,7 @@ jobs:
       # https://learn.microsoft.com/nuget/nuget-org/trusted-publishing
       - name: NuGet login (trusted publishing)
         id: nuget-login
-        uses: NuGet/login@v1
+        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1
         with:
           user: ${{ secrets.NUGET_USER }}
 
@@ -149,7 +149,7 @@ jobs:
 
       - name: Open public API promotion PR
         id: cpr
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
         with:
           # AUTOMATION_TOKEN lets the required `build` check run on the PR; with
           # the default GITHUB_TOKEN, pushes from a workflow do not trigger CI.
diff --git a/.github/workflows/version-bump.yml b/.github/workflows/version-bump.yml
@@ -40,7 +40,7 @@ jobs:
           fi
 
       - name: Open version bump PR
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
         with:
           # A PAT or GitHub App token (AUTOMATION_TOKEN) lets the required `build`
           # check run on the PR. With the default GITHUB_TOKEN, pushes from this
