fix(ci): harden GitHub Actions workflows (#377)

.github/workflows/build-push-unity.yml

@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   buildForAllSupportedPlatforms:
+    permissions:
+      contents: read
     name: Build ${{ matrix.targetPlatform }}
     runs-on: ubuntu-latest
     strategy:
@@ -84,10 +88,11 @@ jobs:
   #         path: ./builds/Standalone.tar.gz
 
   PushToHub:
+    permissions: {}
     name: Upload if release
     needs: [buildForAllSupportedPlatforms]
     runs-on: ubuntu-latest
-    # if: github.event_name == 'release' && github.event.action == 'published'
+    if: github.event_name == 'release' && github.event.action == 'published'
 
     steps:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
@@ -100,6 +105,7 @@ jobs:
           path: builds
 
       - name: Push builds to Hub
+        if: github.event_name == 'release' && github.event.action == 'published'
         env:
           HF_TOKEN: ${{ secrets.UNITY_BUILD_PUSH }}
           HF_USERNAME: thomwolf

.github/workflows/pip.yml

@@ -11,8 +11,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -22,9 +26,9 @@ jobs:
     runs-on: ${{ matrix.platform }}
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-    - uses: actions/setup-python@v7
+    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: ${{ matrix.python-version }}
 

.github/workflows/quality.yml

@@ -2,13 +2,17 @@ name: Quality Check
 
 on: [pull_request]
 
+permissions: {}
+
 jobs:
   quality:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Set up Python 3.8
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: 3.8
     - name: Install Python dependencies

.github/workflows/tests-no-deps.yml

@@ -5,8 +5,12 @@ on: [pull_request]
 env:
   HF_HOME: ~/hf_cache
 
+permissions: {}
+
 jobs:
   run-tests:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
 
     strategy:

.github/workflows/tests.yml

@@ -5,8 +5,12 @@ on: [pull_request]
 env:
   HF_HOME: ~/hf_cache
 
+permissions: {}
+
 jobs:
   run-tests:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
 
     strategy:
@@ -21,14 +25,14 @@ jobs:
             vtk-version: 'latest'
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
 
-      - uses: actions/cache@v6
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/pip
           key: Python-${{ runner.os }}-${{ matrix.python-version }}-${{ matrix.vtk-version }}-${{ hashFiles('setup.py') }}-${{ hashFiles('requirements_test.txt') }}

.github/workflows/wheels.yml

@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build_sdist:
+    permissions:
+      contents: read
     name: Build SDist
     runs-on: ubuntu-latest
     steps:
@@ -33,6 +37,8 @@ jobs:
 
 
   build_wheels:
+    permissions:
+      contents: read
     name: Wheels on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
     strategy:
@@ -43,7 +49,7 @@ jobs:
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-    - uses: pypa/cibuildwheel@v4.2.1
+    - uses: pypa/cibuildwheel@e090b81e30c4d855ea63bf4b6e59204c09a101ae # v4.2.1
       env:
         CIBW_ARCHS_MACOS: auto universal2
         CIBW_SKIP: cp311-* *-win32 pp38-* pp39-* *_i686 *-musllinux_* cp38-*-universal2
@@ -60,6 +66,7 @@ jobs:
 
 
   upload_all:
+    permissions: {}
     name: Upload if release
     needs: [build_wheels, build_sdist]
     runs-on: ubuntu-latest
@@ -75,7 +82,7 @@ jobs:
         name: artifact
         path: dist
 
-    - uses: pypa/gh-action-pypi-publish@v1.14.2
+    - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
       with:
         user: thomwolf
         password: ${{ secrets.pypi_password }}