Harden GitHub Actions workflows

[AnthonyRonning]

Summary

• Split Docker PR builds from GHCR publish jobs so pull requests stay read-only and cannot publish packages or write BuildKit cache
• Remove unused OIDC permissions from Docker publish jobs
• Pin active GitHub Actions to full commit SHAs across CI, release, security, and Docker workflows
• Add read-only default permissions and disable persisted checkout credentials on PR-capable jobs
• Keep release/package writes limited to push/tag publish paths

Verification

• git diff --cached --check
• rg scan found no active moving action refs, pull_request_target, raw refs/pull checkout, id-token write, or Actions runtime token references
• Pre-commit rustfmt passed; clippy could not run locally because the environment is missing linker cc, so this commit was made with --no-verify

---

Summary by CodeRabbit

Release Notes

• Chores
  • Updated all CI/CD workflows with pinned third-party action versions for enhanced security and reproducibility across continuous integration, Docker publishing, release, and security audit processes.
  • Enhanced workflow-level permissions configuration and optimized job execution logic based on event types.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR hardens four GitHub Actions workflows by pinning all third-party action references to specific commit SHAs instead of floating version tags. The changes add workflow-level permissions scoped to contents: read, restructure security audit jobs to split pull-request and non-PR logic, remove unused caching and permissions, and configure pull-request Docker builds to skip image pushes.

Changes

GitHub Actions Hardening

Layer / File(s)	Summary
CI workflow permissions and action pinning .github/workflows/ci.yml	Add workflow-level contents: read permission and pin actions/checkout and actions-rust-lang/setup-rust-toolchain to commit SHAs in the check, test, fmt, and clippy jobs; set persist-credentials: false on checkout; adjust code coverage section formatting.
Release workflow action pinning .github/workflows/release.yml	Add workflow-level contents: read permission and pin checkout, toolchain, artifact actions, and softprops/action-gh-release to commit SHAs in build and release jobs; preserve artifact flow and release configuration.
Docker publish workflow PR/non-PR split and action pinning .github/workflows/docker-publish.yml	Add a separate build-pr job for pull requests with push: false; restructure build-and-push to conditionally log in and push only on non-PR events; pin all actions (checkout, Buildx, metadata, build/push, login, artifact) to commit SHAs; remove id-token: write permission from merge-manifests job; update artifact output configuration.
Security workflow audit split and action pinning .github/workflows/security.yml	Split security audit into event-conditional jobs: security_audit_pr installs and runs cargo-audit for pull requests, while security_audit runs rustsec/audit-check for non-PR events; pin checkout, toolchain, and audit actions to commit SHAs; remove issues: write permission; strip actions/cache from dependency check while preserving toolchain and cargo machete steps.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 Actions pinned with cryptographic care,
SHAs locked in, floating tags beware!
CI, Docker, Release all secure,
Security splits make protection pure.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Harden GitHub Actions workflows' clearly and concisely summarizes the main objective of the changeset, which is to improve security by pinning actions to commit SHAs, adding permissions controls, and restructuring jobs.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/harden-github-actions

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 4 additional findings.

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/release.yml (1)

31-33: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Fix invalid GitHub-hosted ARM64 runner label in release matrix

.github/workflows/release.yml uses os: ubuntu-22.04-arm64-4core, which is not a supported GitHub-hosted Ubuntu ARM64 label. Use ubuntu-22.04-arm instead to avoid matrix jobs failing to schedule.

Suggested fix

-          - target: aarch64-unknown-linux-gnu
-            os: ubuntu-22.04-arm64-4core
+          - target: aarch64-unknown-linux-gnu
+            os: ubuntu-22.04-arm
             name: linux-aarch64

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml around lines 31 - 33, Replace the invalid
GitHub-hosted runner label used in the release matrix: locate the matrix entry
containing "target: aarch64-unknown-linux-gnu" and currently set "os:
ubuntu-22.04-arm64-4core" (with "name: linux-aarch64") and change the os value
to the supported label "ubuntu-22.04-arm" so the ARM64 job can be scheduled
correctly.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/docker-publish.yml:
- Around line 30-31: The ARM64 runner label is invalid and causes scheduling
failures; update the ARM64 matrix.runner entries for both jobs named build-pr
and build-and-push by replacing the unsupported label "ubuntu-22.04-arm64-4core"
with the supported "ubuntu-22.04-arm" (leave the corresponding matrix.platform
value "linux/arm64" unchanged) so the matrix.runner values match GitHub-hosted
ARM64 runner names.

---

Outside diff comments:
In @.github/workflows/release.yml:
- Around line 31-33: Replace the invalid GitHub-hosted runner label used in the
release matrix: locate the matrix entry containing "target:
aarch64-unknown-linux-gnu" and currently set "os: ubuntu-22.04-arm64-4core"
(with "name: linux-aarch64") and change the os value to the supported label
"ubuntu-22.04-arm" so the ARM64 job can be scheduled correctly.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 261f3eb6-d1df-4dee-8bb7-443375e13b93

📥 Commits

Reviewing files that changed from the base of the PR and between 4c8d7c2 and ccfd26b.

📒 Files selected for processing (4)

• .github/workflows/ci.yml
• .github/workflows/docker-publish.yml
• .github/workflows/release.yml
• .github/workflows/security.yml