Harden release workflows against tag injection and credential leakage (#45)

* Harden release workflows against tag injection and credential leakage

Made-with: Cursor

* Set workflow-level permissions to {} for least-privilege

The job already declares contents: write, so the workflow-level
contents: read was redundant. Empty permissions at workflow level
ensures no implicit grants.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Author: Mpdreamz

.github/workflows/create-major-tag.yml

@@ -5,19 +5,37 @@ on:
     types:
       - published
 
-permissions:
-  contents: write
+permissions: {}
+
+concurrency:
+  group: create-major-tag
+  cancel-in-progress: false
 
 jobs:
   create-major-tag:
+    permissions:
+      contents: write
     runs-on: ubuntu-slim
     steps:
       - uses: actions/checkout@v6
-      - name: Get major version
+        with:
+          persist-credentials: false
+
+      - name: Validate and extract major version
+        env:
+          TAG: ${{ github.event.release.tag_name }}
         run: |
-          MAJOR_VERSION=$(echo "${GITHUB_REF#refs/tags/}" | awk -F. '{print $1}')
-          echo "MAJOR_VERSION=${MAJOR_VERSION}" >> "${GITHUB_ENV}"
+          if [[ ! "$TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::Tag '${TAG}' does not match expected semver format (N.N.N)"
+            exit 1
+          fi
+          echo "MAJOR_VERSION=${TAG%%.*}" >> "${GITHUB_ENV}"
+
       - name: Create major tag
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
           git tag "v${MAJOR_VERSION}"
           git push -f origin "refs/tags/v${MAJOR_VERSION}"
+          git remote set-url origin "https://github.com/${GITHUB_REPOSITORY}.git"

.github/workflows/required-labels.yml

@@ -19,13 +19,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+        with:
+          sparse-checkout: .github/release-drafter.yml
+          persist-credentials: false
       - name: Wait for PR to be ready (if just opened)
         if: github.event_name == 'pull_request_target' && github.event.action == 'opened'
         run: sleep 30
       - id: get-labels
         run: |
-          labels=$(yq '[.categories[].labels] + .exclude-labels | flatten | unique | sort | @tsv' .github/release-drafter.yml | tr '\t' ',')
-          echo "labels=$labels" >> "${GITHUB_OUTPUT}"
+          delimiter="$(openssl rand -hex 16)"
+          {
+            echo "labels<<${delimiter}"
+            yq '[.categories[].labels] + .exclude-labels | flatten | unique | sort | @tsv' .github/release-drafter.yml | tr '\t' ','
+            echo "${delimiter}"
+          } >> "${GITHUB_OUTPUT}"
       - id: check-labels
         uses: mheap/github-action-required-labels@8afbe8ae6ab7647d0c9f0cfa7c2f939650d22509 # v5.5
         with: