Harden workflow credentials (koxudaxi#3095)

* Harden auto-fix workflows

* Harden release workflows

* Harden workflow credentials

* Fix docs preview comment permissions

* Refactor workflow autofix and docs sync

* Add test workflow gate

* Harden generated docs sync push

* Harden workflow ownership and pins

* Split release draft privileges

* Harden release draft workflow

Author: koxudaxi

.github/CODEOWNERS

@@ -0,0 +1,12 @@
+# Protect automation that can affect CI/CD behavior or main-only trusted jobs.
+/.github/workflows/** @koxudaxi
+/.github/CODEOWNERS @koxudaxi
+/.pre-commit-config.yaml @koxudaxi
+/tox.ini @koxudaxi
+/zensical.toml @koxudaxi
+/scripts/update_command_help_on_markdown.py @koxudaxi
+/scripts/build_cli_docs.py @koxudaxi
+/scripts/build_prompt_data.py @koxudaxi
+/scripts/build_schema_docs.py @koxudaxi
+/scripts/build_llms_txt.py @koxudaxi
+/scripts/update_docs_version.py @koxudaxi

.github/dependabot.yaml

@@ -10,3 +10,15 @@ updates:
   allow:
   - dependency-type: direct
   - dependency-type: indirect
+- package-ecosystem: github-actions
+  directory: "/"
+  schedule:
+    interval: weekly
+    day: thursday
+    time: "10:30"
+    timezone: Asia/Tokyo
+  open-pull-requests-limit: 10
+  groups:
+    github-actions:
+      patterns:
+      - "*"

.github/workflows/changelog.yaml

@@ -5,15 +5,17 @@ on:
     types: [published]
 
 jobs:
-  update-changelog:
+  build-changelog:
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: read
+    outputs:
+      has_changes: ${{ steps.patch.outputs.has_changes }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           ref: main
-          token: ${{ secrets.PAT }}
+          persist-credentials: false
 
       - name: Get release info and update CHANGELOG
         env:
@@ -60,10 +62,56 @@ jobs:
           cat header.md new_entry.md old_entries.md > CHANGELOG.md
           rm -f header.md new_entry.md old_entries.md
 
+      - name: Create changelog patch
+        id: patch
+        env:
+          PATCH_PATH: ${{ runner.temp }}/changelog.patch
+        run: |
+          set -euo pipefail
+          if git diff --quiet -- CHANGELOG.md; then
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          git diff --binary -- CHANGELOG.md > "$PATCH_PATH"
+          echo "has_changes=true" >> "$GITHUB_OUTPUT"
+      - name: Upload changelog patch
+        if: steps.patch.outputs.has_changes == 'true'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: changelog-patch
+          path: ${{ runner.temp }}/changelog.patch
+          if-no-files-found: error
+
+  commit-changelog:
+    needs: build-changelog
+    if: needs.build-changelog.outputs.has_changes == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          ref: main
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Download changelog patch
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: changelog-patch
+          path: ${{ runner.temp }}
       - name: Commit and push
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PATCH_PATH: ${{ runner.temp }}/changelog.patch
         run: |
+          set -euo pipefail
+          git apply --index --whitespace=nowarn "$PATCH_PATH"
+          if git diff --staged --quiet; then
+            exit 0
+          fi
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add CHANGELOG.md
-          git diff --cached --quiet || git commit -m "docs: update CHANGELOG.md for ${{ github.event.release.tag_name }}"
-          git push
+          git commit -m "docs: update CHANGELOG.md for ${{ github.event.release.tag_name }}"
+          git fetch origin main
+          git rebase origin/main
+          git push "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git" HEAD:main

.github/workflows/cli-docs.yaml

@@ -1,15 +1,6 @@
 name: Update CLI Docs
 
 on:
-  push:
-    branches: [main]
-    paths:
-      - 'tests/main/**'
-      - 'tests/test_main_kr.py'
-      - 'src/datamodel_code_generator/arguments.py'
-      - 'src/datamodel_code_generator/cli_options.py'
-      - 'scripts/build_cli_docs.py'
-      - 'scripts/build_prompt_data.py'
   pull_request:
     branches: [main]
     paths:
@@ -19,50 +10,24 @@ on:
       - 'src/datamodel_code_generator/cli_options.py'
       - 'scripts/build_cli_docs.py'
       - 'scripts/build_prompt_data.py'
-  pull_request_target:
-    types: [labeled]
-    paths:
-      - 'tests/main/**'
-      - 'tests/test_main_kr.py'
-      - 'src/datamodel_code_generator/arguments.py'
-      - 'src/datamodel_code_generator/cli_options.py'
-      - 'scripts/build_cli_docs.py'
-      - 'scripts/build_prompt_data.py'
+      - 'docs/cli-reference/**'
+      - 'src/datamodel_code_generator/prompt_data.py'
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   update-cli-docs:
-    if: |
-      github.event_name == 'push' ||
-      !github.event.pull_request.head.repo.fork ||
-      github.actor == 'koxudaxi' ||
-      github.actor == 'gaborbernat' ||
-      github.actor == 'ilovelinux' ||
-      (github.event_name == 'pull_request_target' && github.event.label.name == 'safe-to-fix' &&
-       (github.event.sender.login == 'koxudaxi' ||
-        github.event.sender.login == 'gaborbernat' ||
-        github.event.sender.login == 'ilovelinux'))
     runs-on: ubuntu-latest
     steps:
-      # Checkout for forks (no PAT available)
-      - uses: actions/checkout@v4
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.ref }}
+          ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
-      # Checkout for same-repo PRs, pushes, and pull_request_target
-      - uses: actions/checkout@v4
-        if: github.event_name == 'push' || github.event_name == 'pull_request_target' || github.event.pull_request.head.repo.full_name == github.repository
-        with:
-          fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.ref || github.ref }}
-          repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
-          token: ${{ secrets.PAT }}
+          persist-credentials: false
       - name: Install the latest version of uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
       - name: Install tox
         run: uv tool install --python-preference only-managed --python 3.13 tox --with tox-uv
       - name: Setup environment
@@ -75,13 +40,3 @@ jobs:
         run: .tox/cli-docs/bin/python scripts/build_cli_docs.py
       - name: Build prompt data
         run: .tox/cli-docs/bin/python scripts/build_prompt_data.py
-      - name: Commit and push if changed
-        if: github.event_name == 'push' || github.event_name == 'pull_request_target' || github.event.pull_request.head.repo.full_name == github.repository
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add docs/cli-reference/ src/datamodel_code_generator/prompt_data.py
-          git diff --staged --quiet || git commit -m "docs: update CLI reference documentation and prompt data
-
-          🤖 Generated by GitHub Actions"
-          git push

.github/workflows/codeql.yaml

@@ -29,18 +29,20 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@ce64ddcb0d8d890d2df4a9d1c04ff297367dea2a # v3
         with:
           languages: ${{ matrix.language }}
           queries: +security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v2
+        uses: github/codeql-action/autobuild@ce64ddcb0d8d890d2df4a9d1c04ff297367dea2a # v3
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@ce64ddcb0d8d890d2df4a9d1c04ff297367dea2a # v3
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/codespell.yaml

@@ -22,9 +22,11 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       - name: Codespell
-        uses: codespell-project/actions-codespell@v2
+        uses: codespell-project/actions-codespell@406322ec52dd7b488e48c1c4b82e2a8b3a1bf630 # v2
         with:
           exclude_file: CODE_OF_CONDUCT.md
           skip: ./docs/cli-reference,./docs/llms.txt,./docs/llms-full.txt

.github/workflows/codspeed.yaml

@@ -13,22 +13,27 @@ concurrency:
   group: codespeed-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   benchmarks:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       # uv standalone build is not compatible with CodSpeedHQ
       # https://github.com/astral-sh/uv/issues/11006
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.14.2"
       - name: Install the latest version of uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
       - name: Install dependencies
         run: uv sync --all-extras --group benchmark
       - name: Run benchmarks
-        uses: CodSpeedHQ/action@v4
+        uses: CodSpeedHQ/action@db35df748deb45fdef0960669f57d627c1956c30 # v4
         with:
           token: ${{ secrets.CODSPEED_TOKEN }}
           run: .venv/bin/pytest tests/main/test_performance.py --codspeed

.github/workflows/config-types.yaml

@@ -14,13 +14,18 @@ on:
       - 'pyproject.toml'
       - '.github/workflows/config-types.yaml'
 
+permissions:
+  contents: read
+
 jobs:
   config-types:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
-      - uses: astral-sh/setup-uv@v5
+      - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
         with:
           enable-cache: true
 

.github/workflows/docs-deploy.yaml

@@ -0,0 +1,61 @@
+name: Docs Deploy
+
+on:
+  workflow_call:
+    inputs:
+      checkout_ref:
+        required: true
+        type: string
+      deploy_branch:
+        required: false
+        type: string
+        default: ''
+    secrets:
+      CLOUDFLARE_API_TOKEN:
+        required: false
+      CLOUDFLARE_ACCOUNT_ID:
+        required: false
+
+jobs:
+  build-deploy:
+    runs-on: ubuntu-24.04
+    concurrency:
+      group: docs-deploy-${{ inputs.deploy_branch || inputs.checkout_ref }}
+      cancel-in-progress: true
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          ref: ${{ inputs.checkout_ref }}
+          persist-credentials: false
+      - name: Install the latest version of uv
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
+        with:
+          python-version: 3.13
+      - name: Install dependencies
+        run: uv sync
+      - name: Copy CHANGELOG to docs
+        run: |
+          if [ -f CHANGELOG.md ]; then
+            cp CHANGELOG.md docs/changelog.md
+          else
+            echo "# Changelog" > docs/changelog.md
+            echo "" >> docs/changelog.md
+            echo "Changelog will be available after the first release." >> docs/changelog.md
+          fi
+      - name: Update GitHub Action version in docs
+        run: python scripts/update_docs_version.py
+        env:
+          GH_TOKEN: ${{ github.token }}
+      - name: Build site
+        run: zensical build --clean
+      - name: Deploy
+        if: inputs.deploy_branch != ''
+        env:
+          DEPLOY_BRANCH: ${{ inputs.deploy_branch }}
+        uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          command: pages deploy site --project-name=datamodel-code-generator --branch="$DEPLOY_BRANCH"