ci: harden GitHub Actions workflows (zizmor audit)

- Pin all unpinned action refs to immutable commit SHAs (tag
  immutability verified via GitHub rulesets API for each repo;
  all returned false/empty so SHA pinning applied)
- Add top-level `permissions: contents: read` to ci.yml, test.yml,
  and validate.yml (publish.yml already had per-job permissions)
- Add `persist-credentials: false` to all actions/checkout steps
  to prevent credential leakage through GitHub Actions artifacts

Findings addressed: unpinned-uses (40 errors), excessive-permissions
(27 warnings), artipacked (26 warnings) — 93 findings total

Actions pinned:
  actions/checkout v4                  -> 34e114876b0b11c390a56381ad16ebd13914f8d5
  actions/publish-immutable-action v0.0.4 -> 4bc8754ffc40f27910afb20287dbbbb675a4e978
  docker/setup-qemu-action v3          -> c7c53464625b32c7a7e944ae62b3e17d2b600130
  docker/build-push-action v6          -> 10e90e3645eae34f1e60eeb005ba3a3d33f178e8
  docker/build-push-action master      -> 789f68658055d3ca993799b232b5c46dfe3f114d
  docker/bake-action v5                -> 4a9a8d494466d37134e2bfca2d3a8de8fb2681ad
  crazy-max/ghaction-dump-context v2   -> 5355a8e5e6ac5a302e746a1c4b7747a0393863c8
  codecov/codecov-action v4            -> b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238
  crazy-max/.github install-k3s        -> already SHA-pinned (skipped)

.github/workflows/ci.yml

@@ -15,6 +15,9 @@ on:
       - 'v*'
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   main:
     runs-on: ubuntu-latest
@@ -30,7 +33,9 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       -
         name: Set up Docker Buildx
         id: buildx
@@ -49,7 +54,9 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       -
         name: Set up Docker Buildx 1
         uses: ./
@@ -62,7 +69,9 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       -
         name: Stop docker
         run: |
@@ -83,14 +92,16 @@ jobs:
       -
         name: Dump context
         if: always()
-        uses: crazy-max/ghaction-dump-context@v2
+        uses: crazy-max/ghaction-dump-context@5355a8e5e6ac5a302e746a1c4b7747a0393863c8 # v2
 
   debug:
     runs-on: ubuntu-latest
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       -
         name: Create Dockerfile
         run: |
@@ -100,7 +111,7 @@ jobs:
           EOL
       -
         name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
       -
         name: Set up Docker Buildx
         uses: ./
@@ -108,7 +119,7 @@ jobs:
           buildkitd-flags: --debug
       -
         name: Build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/ppc64le
@@ -118,7 +129,9 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       -
         name: Set up Docker Buildx
         uses: ./
@@ -140,7 +153,9 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       -
         name: Set up Docker Buildx
         uses: ./
@@ -163,7 +178,9 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       -
         name: Set up Docker Buildx
         uses: ./
@@ -176,7 +193,9 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       -
         name: Set up Docker Buildx
         uses: ./
@@ -209,7 +228,9 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       -
         name: Create context
         run: |
@@ -231,7 +252,9 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       -
         name: Create buildkitd conf
         run: |
@@ -254,7 +277,7 @@ jobs:
           buildkitd-config: /tmp/buildkitd.toml
       -
         name: Build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
 
@@ -263,7 +286,9 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       -
         name: Create Dockerfile
         run: |
@@ -281,7 +306,7 @@ jobs:
               mirrors = ["mirror.gcr.io"]
       -
         name: Build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
 
@@ -299,10 +324,12 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       -
         name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
         with:
           platforms: ${{ matrix.qemu-platforms }}
       -
@@ -328,7 +355,9 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       -
         name: Set up Docker Buildx
         uses: ./
@@ -342,7 +371,7 @@ jobs:
           EOL
       -
         name: Build
-        uses: docker/build-push-action@master
+        uses: docker/build-push-action@789f68658055d3ca993799b232b5c46dfe3f114d # master
         with:
           context: .
 
@@ -351,7 +380,9 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       -
         name: Uninstall docker cli
         run: |
@@ -379,7 +410,9 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       -
         name: Uninstall docker cli
         run: |
@@ -401,7 +434,7 @@ jobs:
           EOL
       -
         name: Build
-        uses: docker/build-push-action@master
+        uses: docker/build-push-action@789f68658055d3ca993799b232b5c46dfe3f114d # master
         with:
           context: .
 
@@ -410,7 +443,9 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       -
         name: Uninstall docker cli
         run: |
@@ -440,7 +475,9 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       -
         name: Create dummy contexts
         run: |
@@ -469,10 +506,12 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       -
         name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
       -
         name: Set up Docker Buildx
         uses: ./
@@ -484,7 +523,9 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       -
         name: Create Docker context
         run: |
@@ -507,7 +548,9 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       -
         name: Set up Docker Buildx
         uses: ./
@@ -525,7 +568,9 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       -
         name: Install k3s
         uses: crazy-max/.github/.github/actions/install-k3s@605d30d5ae97f6680578ace4b56645af79343e60
@@ -560,7 +605,7 @@ jobs:
           EOL
       -
         name: Build
-        uses: docker/build-push-action@master
+        uses: docker/build-push-action@789f68658055d3ca993799b232b5c46dfe3f114d # master
         with:
           context: .
 
@@ -575,7 +620,9 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       -
         name: Set up Docker Buildx
         uses: ./

.github/workflows/publish.yml

@@ -15,7 +15,9 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       -
         name: Publish
-        uses: actions/publish-immutable-action@v0.0.4
+        uses: actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978 # v0.0.4

.github/workflows/test.yml

@@ -11,24 +11,29 @@ on:
       - 'releases/v*'
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       -
         name: Set up Docker Buildx
         uses: ./
       -
         name: Test
-        uses: docker/bake-action@v5
+        uses: docker/bake-action@4a9a8d494466d37134e2bfca2d3a8de8fb2681ad # v5
         with:
           targets: test
       -
         name: Upload coverage
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4
         with:
           file: ./coverage/clover.xml
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/validate.yml

@@ -11,6 +11,9 @@ on:
       - 'releases/v*'
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   prepare:
     runs-on: ubuntu-latest
@@ -19,7 +22,9 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       -
         name: Targets matrix
         id: targets
@@ -37,9 +42,11 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       -
         name: Validate
-        uses: docker/bake-action@v5
+        uses: docker/bake-action@4a9a8d494466d37134e2bfca2d3a8de8fb2681ad # v5
         with:
           targets: ${{ matrix.target }}