Harden auto-fix workflows

.github/workflows/changelog.yaml

@@ -8,12 +8,12 @@ jobs:
   update-changelog:
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: read
     steps:
       - uses: actions/checkout@v4
         with:
           ref: main
-          token: ${{ secrets.PAT }}
+          persist-credentials: false
 
       - name: Get release info and update CHANGELOG
         env:
@@ -61,9 +61,11 @@ jobs:
           rm -f header.md new_entry.md old_entries.md
 
       - name: Commit and push
+        env:
+          PUSH_TOKEN: ${{ secrets.PAT }}
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git add CHANGELOG.md
           git diff --cached --quiet || git commit -m "docs: update CHANGELOG.md for ${{ github.event.release.tag_name }}"
-          git push
+          git push "https://x-access-token:${PUSH_TOKEN}@github.com/${{ github.repository }}.git" HEAD:main

.github/workflows/cli-docs.yaml

@@ -19,48 +19,30 @@ on:
       - 'src/datamodel_code_generator/cli_options.py'
       - 'scripts/build_cli_docs.py'
       - 'scripts/build_prompt_data.py'
-  pull_request_target:
-    types: [labeled]
-    paths:
-      - 'tests/main/**'
-      - 'tests/test_main_kr.py'
-      - 'src/datamodel_code_generator/arguments.py'
-      - 'src/datamodel_code_generator/cli_options.py'
-      - 'scripts/build_cli_docs.py'
-      - 'scripts/build_prompt_data.py'
 
 permissions:
   contents: write
 
 jobs:
   update-cli-docs:
-    if: |
-      github.event_name == 'push' ||
-      !github.event.pull_request.head.repo.fork ||
-      github.actor == 'koxudaxi' ||
-      github.actor == 'gaborbernat' ||
-      github.actor == 'ilovelinux' ||
-      (github.event_name == 'pull_request_target' && github.event.label.name == 'safe-to-fix' &&
-       (github.event.sender.login == 'koxudaxi' ||
-        github.event.sender.login == 'gaborbernat' ||
-        github.event.sender.login == 'ilovelinux'))
     runs-on: ubuntu-latest
     steps:
-      # Checkout for forks (no PAT available)
+      # Fork PRs run read-only without repository credentials.
       - uses: actions/checkout@v4
         if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository
         with:
           fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.ref }}
+          ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
-      # Checkout for same-repo PRs, pushes, and pull_request_target
+          persist-credentials: false
+      # Same-repo branches can keep credentials for generated-file pushes.
       - uses: actions/checkout@v4
-        if: github.event_name == 'push' || github.event_name == 'pull_request_target' || github.event.pull_request.head.repo.full_name == github.repository
+        if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.ref || github.ref }}
           repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
-          token: ${{ secrets.PAT }}
+          token: ${{ github.token }}
       - name: Install the latest version of uv
         uses: astral-sh/setup-uv@v5
       - name: Install tox
@@ -76,7 +58,7 @@ jobs:
       - name: Build prompt data
         run: .tox/cli-docs/bin/python scripts/build_prompt_data.py
       - name: Commit and push if changed
-        if: github.event_name == 'push' || github.event_name == 'pull_request_target' || github.event.pull_request.head.repo.full_name == github.repository
+        if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"

.github/workflows/codeql.yaml

@@ -30,17 +30,19 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@v3
         with:
           languages: ${{ matrix.language }}
           queries: +security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v2
+        uses: github/codeql-action/autobuild@v3
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@v3
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/codespell.yaml

@@ -23,6 +23,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Codespell
         uses: codespell-project/actions-codespell@v2
         with:

.github/workflows/docs.yaml

@@ -18,10 +18,10 @@ jobs:
     runs-on: ubuntu-24.04
     permissions:
       contents: read
-      pull-requests: write
-      issues: write
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Install the latest version of uv
       uses: astral-sh/setup-uv@v5
       with:
@@ -53,15 +53,38 @@ jobs:
         accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
         command: pages deploy site --project-name=datamodel-code-generator --branch=pr-${{ github.event.pull_request.number }}
 
+    # Dev Deploy (on push to main)
+    - name: Deploy Dev
+      if: github.event_name == 'push'
+      uses: cloudflare/wrangler-action@v3
+      with:
+        apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+        accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        command: pages deploy site --project-name=datamodel-code-generator --branch=dev
+
+    # Production Deploy (on release only)
+    - name: Deploy Production
+      if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
+      uses: cloudflare/wrangler-action@v3
+      with:
+        apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+        accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        command: pages deploy site --project-name=datamodel-code-generator --branch=main
+
+  comment-preview:
+    runs-on: ubuntu-24.04
+    needs: build-deploy
+    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
+    permissions:
+      issues: write
+    steps:
     - name: Comment Preview URL on PR
-      if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
-      uses: actions/github-script@v7
+      uses: actions/github-script@v8
       with:
         script: |
           const previewUrl = 'https://pr-${{ github.event.pull_request.number }}.datamodel-code-generator.pages.dev';
           const body = `📚 **Docs Preview:** ${previewUrl}`;
 
-          // Check if comment already exists
           const comments = await github.rest.issues.listComments({
             issue_number: context.issue.number,
             owner: context.repo.owner,
@@ -85,21 +108,3 @@ jobs:
               body: body
             });
           }
-
-    # Dev Deploy (on push to main)
-    - name: Deploy Dev
-      if: github.event_name == 'push'
-      uses: cloudflare/wrangler-action@v3
-      with:
-        apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-        accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-        command: pages deploy site --project-name=datamodel-code-generator --branch=dev
-
-    # Production Deploy (on release only)
-    - name: Deploy Production
-      if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
-      uses: cloudflare/wrangler-action@v3
-      with:
-        apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-        accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-        command: pages deploy site --project-name=datamodel-code-generator --branch=main

.github/workflows/lint.yaml

@@ -3,48 +3,36 @@ on:
   push:
     branches: [main]
   pull_request:
-  pull_request_target:
-    types: [labeled]
+
+permissions:
+  contents: write
 
 jobs:
   lint:
-    if: |
-      github.event_name == 'push' ||
-      github.event_name == 'pull_request' ||
-      (github.event_name == 'pull_request_target' && github.event.label.name == 'safe-to-fix' &&
-       (github.event.sender.login == 'koxudaxi' ||
-        github.event.sender.login == 'gaborbernat' ||
-        github.event.sender.login == 'ilovelinux'))
     runs-on: ubuntu-latest
     steps:
-      # Checkout for forks (no PAT available, auto-commit won't run anyway)
+      # Fork PRs run read-only without repository credentials.
       - uses: actions/checkout@v4
         if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository
         with:
-          ref: ${{ github.event.pull_request.head.ref }}
+          ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
-      # Checkout for same-repo PRs, pushes, and pull_request_target (PAT for auto-commit and workflow retrigger)
+          persist-credentials: false
+      # Same-repo branches can keep credentials for autofix pushes.
       - uses: actions/checkout@v4
-        if: github.event_name == 'push' || github.event_name == 'pull_request_target' || github.event.pull_request.head.repo.full_name == github.repository
+        if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
         with:
           ref: ${{ github.event.pull_request.head.ref || github.ref }}
           repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
-          token: ${{ secrets.PAT }}
+          token: ${{ github.token }}
       - uses: astral-sh/setup-uv@v5
       - uses: actions/setup-python@v5
         with:
           python-version: "3.14"
       - run: SKIP=readme,config-types,schema-docs uvx prek run --all-files --show-diff-on-failure
       - if: |
           github.event_name == 'push' ||
-          github.event.pull_request.head.repo.full_name == github.repository ||
-          github.actor == 'koxudaxi' ||
-          github.actor == 'gaborbernat' ||
-          github.actor == 'ilovelinux' ||
-          (github.event_name == 'pull_request_target' && github.event.label.name == 'safe-to-fix' &&
-           (github.event.sender.login == 'koxudaxi' ||
-            github.event.sender.login == 'gaborbernat' ||
-            github.event.sender.login == 'ilovelinux'))
+          github.event.pull_request.head.repo.full_name == github.repository
         uses: stefanzweifel/git-auto-commit-action@v5
         with:
           commit_message: "style: auto-fix by prek"

.github/workflows/llms-txt.yaml

@@ -13,43 +13,30 @@ on:
       - 'docs/**/*.md'
       - 'zensical.toml'
       - 'scripts/build_llms_txt.py'
-  pull_request_target:
-    types: [labeled]
-    paths:
-      - 'docs/**/*.md'
-      - 'zensical.toml'
-      - 'scripts/build_llms_txt.py'
 
 permissions:
   contents: write
 
 jobs:
   update-llms-txt:
-    if: |
-      github.event_name == 'push' ||
-      !github.event.pull_request.head.repo.fork ||
-      github.actor == 'koxudaxi' ||
-      github.actor == 'gaborbernat' ||
-      github.actor == 'ilovelinux' ||
-      (github.event_name == 'pull_request_target' && github.event.label.name == 'safe-to-fix' &&
-       (github.event.sender.login == 'koxudaxi' ||
-        github.event.sender.login == 'gaborbernat' ||
-        github.event.sender.login == 'ilovelinux'))
     runs-on: ubuntu-latest
     steps:
+      # Fork PRs run read-only without repository credentials.
       - uses: actions/checkout@v4
         if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository
         with:
           fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.ref }}
+          ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          persist-credentials: false
+      # Same-repo branches can keep credentials for generated-file pushes.
       - uses: actions/checkout@v4
-        if: github.event_name == 'push' || github.event_name == 'pull_request_target' || github.event.pull_request.head.repo.full_name == github.repository
+        if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.ref || github.ref }}
           repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
-          token: ${{ secrets.PAT }}
+          token: ${{ github.token }}
       - name: Install the latest version of uv
         uses: astral-sh/setup-uv@v5
       - name: Install tox
@@ -61,7 +48,7 @@ jobs:
       - name: Build llms.txt
         run: .tox/llms-txt/bin/python scripts/build_llms_txt.py
       - name: Commit and push if changed
-        if: github.event_name == 'push' || github.event_name == 'pull_request_target' || github.event.pull_request.head.repo.full_name == github.repository
+        if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"

.github/workflows/publish.yaml

@@ -11,10 +11,13 @@ env:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Install the latest version of uv
         uses: astral-sh/setup-uv@v5
       - name: Build package
@@ -51,27 +54,31 @@ jobs:
     if: "success() && startsWith(github.ref, 'refs/tags/')"
     runs-on: ubuntu-24.04
     needs: release
+    permissions:
+      contents: read
     steps:
       - name: Check out the repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Docker meta
         id: docker_meta
-        uses: crazy-max/ghaction-docker-meta@v1
+        uses: docker/metadata-action@v5
         with:
           images: koxudaxi/datamodel-code-generator
-          tag-semver: |
-            {{raw}}
+          tags: |
+            type=semver,pattern={{raw}}
       - name: Login to DockerHub
-        uses: docker/login-action@v1
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1
+        uses: docker/setup-qemu-action@v3
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v3
       - name: Build and push
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v6
         with:
           push: true
           tags: ${{ steps.docker_meta.outputs.tags }}