chore: improve workflows security

Author: ldez

.github/workflows/checks.yml

@@ -5,18 +5,24 @@ on:
     branches:
       - main
   pull_request:
-permissions:
-  checks: write # Allow write access to checks to allow annotation of code in the PR.
-  contents: read
-  pull-requests: read
+
+permissions: {}
+
 env:
   CGO_ENABLED: 0
   GOLANGCI_LINT_VERSION: v2.12
+
 jobs:
   go-lint-checks:
     runs-on: ubuntu-latest
+    permissions:
+      checks: write # Allow write access to checks to allow annotation of code in the PR.
+      contents: read
+      pull-requests: read
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
@@ -28,6 +34,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod

.github/workflows/go-cross.yml

@@ -4,9 +4,9 @@ on:
     branches:
       - main
   pull_request:
-permissions:
-  contents: read
-  pull-requests: read
+
+permissions: {}
+
 jobs:
   cross:
     name: Build on ${{ matrix.os }} with Go ${{ matrix.go-version }}
@@ -26,6 +26,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Set up Go
         uses: actions/setup-go@v6
         with:

.github/workflows/release.yml

@@ -33,10 +33,13 @@ jobs:
           - windows
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@v6
         with:
           check-latest: true
           go-version-file: go.mod
+          cache: false
       - name: Build ${{ matrix.app }} for ${{ matrix.go-os }}/${{ matrix.go-arch }}
         run: |
           go build \
@@ -65,6 +68,8 @@ jobs:
           expose_ports: "5001 5002 5003 8053 8055 8443"
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Download ${{ matrix.app }} artifacts
         uses: actions/download-artifact@v8
         with:
@@ -147,6 +152,6 @@ jobs:
           for artifact in *; do
             tar czf ${artifact}.tar.gz ${artifact}
             zip -r ${artifact}.zip ${artifact}
-            gh release upload ${{ github.ref_name }} ${artifact}.* \
+            gh release upload ${GITHUB_REF_NAME} ${artifact}.* \
               --repo ${{ github.repository }};
           done

.github/workflows/tests.yml

@@ -19,6 +19,8 @@ jobs:
       # https://github.com/marketplace/actions/checkout
       - name: Check out code
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       # https://github.com/marketplace/actions/setup-go-environment
       - name: Set up Go
         uses: actions/setup-go@v6
@@ -43,6 +45,8 @@ jobs:
     steps:
       - name: Check out code
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
@@ -64,6 +68,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@v6
         with:
           go-version: stable
@@ -91,6 +97,8 @@ jobs:
     steps:
       - name: Check out code
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       # Run project unit tests (with the race detector enabled and atomic coverage profile collection)
       - name: unittests
         run: go test -v -race -covermode=atomic -coverprofile=profile.cov ./...