[aterga]

Hardens the CI workflows' token scope and action references.

Changes

• Token scope: tests.yaml, validation.yaml, builds.yaml and benchmarks.yaml now declare permissions: contents: read instead of inheriting the repository default. release.yaml declares contents: write, the only scope orbit-cli release publish needs (push tags, create releases).
• Pinned actions: every uses: in .github/, including the setup-node and setup-python composite actions, is pinned to a full commit SHA with a version comment. Each SHA is what the previous tag/branch resolved to, so the code that runs is unchanged. dfinity/setup-dfx uses the same commit already pinned in .github/actions/deploy-backend.
• Checkout credentials: persist-credentials: false on every checkout that does not push. release.yaml keeps credentials explicitly because it runs git push origin --tags.

Notes

• No scripts run by these jobs make authenticated git or gh calls; artifacts and caches use the runtime token, which permissions: does not affect.
• Recommended alongside this: set the repository's default workflow token permission to read-only.

---

Generated by Claude Code

[Copilot]

🔵 Needs a closer look

No concrete defects were identified, but the pinned commits’ provenance and equivalence to previous references remain unverified.

No open issues 🎉

What changed in this PR

Hardens CI by limiting workflow token permissions and pinning external actions to commit SHAs.

Changes:

• Grants read-only contents access to CI and write access to releases.
• Pins external actions in workflows and shared setup actions.
• Disables persisted checkout credentials except for release publishing.

File	Description
.github/​workflows/​validation.yaml	Restricts permissions, pins actions, and disables credential persistence.
.github/​workflows/​tests.yaml	Applies token, action-reference, and checkout hardening.
.github/​workflows/​release.yaml	Grants release write access and retains push credentials.
.github/​workflows/​builds.yaml	Hardens checkout and pins Docker setup.
.github/​workflows/​benchmarks.yaml	Restricts permissions and pins benchmark dependencies.
.github/​actions/​setup-python/​action.yaml	Pins Python setup.
.github/​actions/​setup-node/​action.yml	Pins Node.js, pnpm, and cache actions.

_{Review effort: Balanced}

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 603c252.

Security Overview

• 🔎 Scanned files: 7 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/5243341a-e7d7-47de-848a-f52264761c93?scanId=0af4ac37-b287-4f24-84c0-9b7604f59573&codeScanTypes=PrScan&tab=issues&detectionTypes=traditional,businessLogic,customRule,IAC,SECRETS,CICD,EOL,uncategorized

Detected Code Changes

Change Type	Relevant files
Enhancement	► .github/actions/setup-node/action.yml       Modify action references to specific commit hashes (v4 equivalents) for setup-node ► .github/actions/setup-python/action.yaml       Update Python setup step to a specific commit hash (v4 equivalent)
Enhancement	► .github/workflows/benchmarks.yaml       Add permissions: contents: read block; adjust checkout and sccache-action references to specific commits; adjust sccache step references ► .github/workflows/builds.yaml       Add permissions: contents: read; update checkout and docker setup steps to specific commits ► .github/workflows/release.yaml       Update checkout step to specific commit; add permissions: contents: write; adjust related comments ► .github/workflows/tests.yaml       Add permissions: contents: read; update checkout and sccache-action references to specific commits ► .github/workflows/validation.yaml       Update checkout steps to specific commits; add permissions: contents: read; update dfx/setup-dfx reference to specific commit