[freeznet]

Motivation

Audit and harden all 11 existing workflows, including PR-controlled execution, cloud secrets, token permissions, remote debugging, release inputs, action dependencies, caches, and artifacts. The full per-workflow findings, behavior changes, and remaining controls are in .github/WORKFLOW_SECURITY.md.

Changes

• Move basic/TLS integration tests to secretless pull_request execution. Run OAuth2/downloader tests only on official-repository master pushes or manual dispatches, with secrets scoped to the E2E step and GSA limited to its required case.
• Remove automatic SSH/upterm/tmate access. Use read-only PR tokens and disable persisted checkout credentials and build caches.
• Separate release-file/SARIF upload permissions from build jobs; consume only same-run artifacts without executing them. Keep release drafting and documentation labeling metadata-only, with three explicit documentation labels.
• Require version tags reachable from master before publishing jobs start, check out the validated commit SHA, and remove mutable release-helper downloads.
• Stop logging the Red Hat authentication JSON, use private temporary files with cleanup, and pin the preflight container digest.
• Pin every third-party workflow action to a verified commit, verify directly downloaded tools with SHA-256, and pin E2E Helm installation/Pulsar chart preparation.
• Add workflow syntax checks and 11 security regression tests.

Validation

Passed locally:

• actionlint 1.7.7 with -shellcheck='' -pyflakes='' across all workflows
• 11 regression tests, including real local Git tag-validation tests, hostile label-body cases, and corrupted Helm downloads rejected before installation
• shell syntax checks for workflow/E2E command blocks
• hash-locked PyYAML wheel download and git diff --check
• independent review of the trust boundaries and validation results

The new Workflow security Actions run also passed on head 0490c93b679bcce9b7ef68f860a99f9c763989e4, including dependency installation, actionlint and the trust-boundary tests. Other PR checks were still running when this note was updated.

Not run locally: Docker/Kubernetes E2E, cloud OAuth/PubSub integration, release publication, or Red Hat submission. No release/cloud workflow was manually dispatched. Check the exact PR-head Actions results before merging.

Review notes

Cloud integration now runs after merge rather than on unmerged PRs. Documentation labeling intentionally drops the old bot's assignment/comment and extra-label behavior. Arbitrary release refs and unmerged release branches are rejected. Existing tag workflows are not retroactively changed. Repository rules, protected environments, credential rotation, cloud IAM, and complete transitive dependency reproducibility remain separate controls; this PR does not modify them.

• doc
• doc-required
• no-need-doc