Fix workflows for reducing risks

Author: jet2jet

.github/workflows/create-release.yml

@@ -4,16 +4,23 @@ on:
   push:
     tags:
       - '*'
+permissions: {}
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   release:
+    name: Create GitHub Release
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: write # for gh release create
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
 
       - name: Extract release notes from CHANGELOG.md
         id: changelog
@@ -31,10 +38,16 @@ jobs:
             echo "EOF" >> "$GITHUB_ENV"
           fi
 
-      - name: Create GitHub Release
-        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
+      - name: Create Release
         if: ${{ startsWith(github.ref, 'refs/tags/') }}
-        with:
-          tag_name: ${{ env.TAG_NAME }}
-          name: ${{ env.TAG_NAME }}
-          body: ${{ env.RELEASE_BODY }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG_NAME: ${{ env.TAG_NAME }}
+          RELEASE_BODY: ${{ env.RELEASE_BODY }}
+        run: |
+          if [ -n "$RELEASE_BODY" ]; then
+            printf '%s\n' "$RELEASE_BODY" > release-notes.md
+            gh release create "$TAG_NAME" --title "$TAG_NAME" --notes-file release-notes.md
+          else
+            gh release create "$TAG_NAME" --title "$TAG_NAME"
+          fi

.github/workflows/main-ci.yml

@@ -1,24 +1,35 @@
 name: Main CI
 on:
   push:
+permissions: {}
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
 
 jobs:
   get-vars:
     uses: ./.github/workflows/nodevars.yml
 
   main:
+    name: Lint and Test
     needs: get-vars
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
       - name: Setup node
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: ${{ needs.get-vars.outputs.node-version }}
           cache: npm
       - name: Setup npm
-        run: npm i -g npm@${{ needs.get-vars.outputs.npm-version }}
+        run: npm i -g npm@${NPM_VERSION}
+        env:
+          NPM_VERSION: ${{ needs.get-vars.outputs.npm-version }}
       - name: Cache node modules
         id: node_modules_cache
         uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
@@ -37,13 +48,16 @@ jobs:
       - name: Test
         run: npm run test
   windows-test:
+    name: Test using Windows environment
     needs: get-vars
     runs-on: windows-latest
     env:
       TEST_IGNORE_256_ICON: 1
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
       - name: Setup node
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
@@ -60,7 +74,9 @@ jobs:
       - name: Install
         if: steps.node_modules_cache.outputs.cache-hit != 'true'
         # use npx instead of installing npm globally to avoid permission error
-        run: npx -y npm@${{ needs.get-vars.outputs.npm-version }} ci
+        run: npx -y npm@${NPM_VERSION} ci
+        env:
+          NPM_VERSION: ${{ needs.get-vars.outputs.npm-version }}
       - name: Test (x86)
         # use normal npm (which should not affect to the test)
         run: npm run test:win-x86

.github/workflows/nodevars.yml

@@ -9,19 +9,21 @@ on:
       npm-version:
         description: 'Common NPM version'
         value: ${{ jobs.export.outputs.npm-version }}
-
 env:
   NODE_VERSION: 20.19.5
   NPM_VERSION: 11.12.1
+permissions: {}
 
 jobs:
   export:
+    name: Output version variables
     runs-on: ubuntu-latest
     outputs:
       node-version: ${{ steps.setver.outputs.node_version }}
       npm-version: ${{ steps.setver.outputs.npm_version }}
     steps:
       - id: setver
+        name: Output variables
         run: |
-          echo "node_version=${{ env.NODE_VERSION }}" >> $GITHUB_OUTPUT
-          echo "npm_version=${{ env.NPM_VERSION }}" >> $GITHUB_OUTPUT
+          echo "node_version=${NODE_VERSION}" >> $GITHUB_OUTPUT
+          echo "npm_version=${NPM_VERSION}" >> $GITHUB_OUTPUT

.github/workflows/publish.yml

@@ -3,29 +3,39 @@ on:
   push:
     tags:
       - 'v*.*.*'
+permissions: {}
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   get-vars:
     uses: ./.github/workflows/nodevars.yml
 
   main:
+    name: Publish package
     needs: get-vars
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      id-token: write
+      id-token: write # for npm publish --provenance
     environment:
       name: Publish
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
       - name: Setup node
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: ${{ needs.get-vars.outputs.node-version }}
           registry-url: 'https://registry.npmjs.org'
+          package-manager-cache: false
       - name: Setup npm
-        run: npm i -g npm@${{ needs.get-vars.outputs.npm-version }}
+        run: npm i -g npm@${NPM_VERSION}
+        env:
+          NPM_VERSION: ${{ needs.get-vars.outputs.npm-version }}
       - name: Install
         run: npm ci
       - name: Build