ci: enhance gh workflow security

Author: fhussonnois

.github/CODEOWNERS

@@ -1 +1,8 @@
-* @fhussonnois
+* @fhussonnois
+
+# Require explicit maintainer review for workflow and AI agent instruction files.
+# Any PR touching these paths must be approved by a maintainer before merge.
+.github/workflows/**  @fhussonnois
+.github/CODEOWNERS    @fhussonnois
+AGENTS.md             @fhussonnois
+CLAUDE.md             @fhussonnois

.github/workflows/docker-build-push.yml

@@ -16,6 +16,10 @@ env:
   JAVA_DISTRO: 'zulu'
   GRAAL_VERSION: '25.0.1'
   GRAAL_DISTRIBUTION: 'graalvm-community'
+
+permissions:
+  contents: read
+
 jobs:
   build-cli:
     if: github.repository == 'streamthoughts/jikkou'

.github/workflows/early-access.yml

@@ -14,6 +14,10 @@ env:
   JAVA_DISTRO: 'zulu'
   GRAAL_VERSION: '25.0.1'
   GRAAL_DISTRIBUTION: 'graalvm-community'
+
+permissions:
+  contents: read
+
 jobs:
   build-distribution:
     if: github.repository == 'streamthoughts/jikkou'
@@ -92,11 +96,12 @@ jobs:
   release-artifacts:
     needs: [ build-distribution ]
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: 'Checkout GitHub repository'
         uses: actions/checkout@v4
         with:
-          ref: ${{ needs.set-release-version.outputs.HEAD }}
           fetch-depth: 0
 
       - name: 'Download all artifacts'

.github/workflows/github-page.yml

@@ -10,9 +10,15 @@ on:
   push:
     branches:
       - main
+
+permissions:
+  contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}
     steps:

.github/workflows/maven-build.yml

@@ -19,13 +19,14 @@ env:
 permissions:
   contents: read
   security-events: write
-  pull-requests: write
 
 jobs:
   build:
     name: Build and analyze
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    permissions:
+      pull-requests: write
     steps:
     - name: 'Checkout code'
       uses: actions/checkout@v4

.github/workflows/maven-deploy.yml

@@ -20,7 +20,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: read
     steps:
       - name: 'Checkout GitHub repository'
         uses: actions/checkout@v4

.github/workflows/release.yml

@@ -21,9 +21,15 @@ env:
   JAVA_DISTRO: 'zulu'
   GRAAL_VERSION: '25.0.1'
   GRAAL_DISTRIBUTION: 'graalvm-community'
+
+permissions:
+  contents: read
+
 jobs:
   set-release-version:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     outputs:
       HEAD: ${{ steps.version.outputs.HEAD }}
       RELEASE_VERSION: ${{ steps.version.outputs.RELEASE_VERSION }}
@@ -57,10 +63,11 @@ jobs:
 
       - name: 'Set release version'
         id: version
+        env:
+          RELEASE_VERSION: ${{ github.event.inputs.version }}
+          NEXT_VERSION: ${{ github.event.inputs.next }}
         run: |
-          RELEASE_VERSION=${{ github.event.inputs.version }}
-          NEXT_VERSION=${{ github.event.inputs.next }}
-          if [ -z $NEXT_VERSION ]
+          if [ -z "$NEXT_VERSION" ]
           then
             PLAIN_VERSION=`echo ${RELEASE_VERSION} | awk 'match($0, /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)/) { print substr($0, RSTART, RLENGTH); }'`
             NEXT_VERSION="${PLAIN_VERSION}-SNAPSHOT"
@@ -78,6 +85,8 @@ jobs:
   build-distribution:
     needs: [ set-release-version ]
     name: 'Build with GraalVM on ${{ matrix.os }}'
+    permissions:
+      contents: read
     strategy:
       fail-fast: true
       matrix:
@@ -153,6 +162,8 @@ jobs:
   release-artifacts:
     needs: [ set-release-version, build-distribution ]
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: 'Checkout GitHub repository'
         uses: actions/checkout@v4
@@ -207,7 +218,7 @@ jobs:
         env:
           NEXT_VERSION: ${{ needs.set-release-version.outputs.NEXT_VERSION }}
         run: |
-          ./mvnw -ntp -B versions:set versions:commit -DnewVersion=${{ env.NEXT_VERSION }}
+          ./mvnw -ntp -B versions:set versions:commit -DnewVersion="$NEXT_VERSION"
           find . -name 'pom.xml' | xargs git add
-          git commit -m "ci: bump version for next iteration to ${{ env.NEXT_VERSION }} 🤖"
+          git commit -m "ci: bump version for next iteration to $NEXT_VERSION"
           git push origin HEAD:${GITHUB_REF#refs/heads/}