[cjbell]

Linear: KNO-16683 (sub-issue of KNO-16655). Workflow-only changes; no version bumps.

Changes

• Pinned all actions to full commit SHAs with version comments (actions/checkout v7.0.1, actions/setup-java v6.1.0, gradle/actions/setup-gradle v6.4.1). These are the commits the existing floating tags (v7, v6, v6) point to, so there is no version change. Each SHA was checked against the upstream repo's own tags, and none of the three repos is a fork. There are no local composite actions.
• Added top-level permissions: contents: read to ci.yml and release-doctor.yml.
• publish-sonatype.yml: top-level permissions: {}, with contents: read granted only on the publish job. The job needs no write access. Secrets stay scoped to the publish step, and the publish steps and release tag/version guard (release: 2.0.0 #43) are unchanged.
• Added persist-credentials: false to every checkout, since no job pushes to git.
• Added concurrency with cancel-in-progress to ci.yml and release-doctor.yml. Their groups are per-ref and per-head-ref, so only superseded runs are cancelled. publish-sonatype.yml has no concurrency, so releases are never cancelled.
• Checked for other attack paths. There are no pull_request_target triggers and no piped installers. The one github.event.* value used in run: (release.tag_name) already goes through an env: variable. The run: steps only call repo scripts.

ci-secure

• Before: 0 findings. After: 0 findings. The scan never saw the missing permissions: or unpinned actions, so the manual changes above are what fixed those.
• Repo-settings API checks (branch protection, fork-PR approval, secrets) returned 403 for this token and were reported as unmeasured.

ci-score

• Before: 44/100 (D-), 4 pass, 5 fail, 2 n/a.
• After: 78/100, 7 pass, 2 fail, 2 n/a.
• Fixed: pinned-action-shas (0/10 to all pinned), concurrency-groups, cancel-superseded.
• Not fixed:
  • test-sharding is not worthwhile for one small Gradle test job.
  • path-filter applies to release-doctor, which must run on every release PR. A path filter could skip a required check.

Stainless-managed files

The repo started as Stainless output, and ci.yml, publish-sonatype.yml and release-doctor.yml match the Stainless-generated templates. These edits may be overwritten on regeneration, so the same changes should go into the Stainless generator config or templates.

Not committed

The skill files that npx skills add created (.agents/, skills-lock.json) are not committed.

CI on this PR will verify that the jobs still pass with read-only permissions.

  

[linear-code]

KNO-16683

[cursor]

Human review is needed for these GitHub Actions workflow changes; they are not an auto-release, dependency, docs-only, or Stainless spec/seal update. No reviewers were assigned in this run. CI is not a substitute for product-team review here.

  

_{Sent by Cursor Approval Agent: SDK approver}