ci: harden repository workflows and action provenance

.github/workflows/fp-conformance.yml

@@ -2,7 +2,7 @@ name: fp-conformance
 
 # Functional-programming conformance ratchet.
 #
-# Deliberately cheap: stdlib Python, no toolchain, no dependency install, no
+# Deliberately cheap: stdlib Python, no dependency install, no dependency
 # network. It compares current findings against the recorded budget and fails
 # only on regression, so the pre-existing backlog never blocks a pull request
 # while new violations do.
@@ -38,14 +38,19 @@ concurrency:
 jobs:
   conformance:
     name: functional programming conformance
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 1
+          show-progress: false
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: '3.11'
+          cache: ''
 
       - name: Scan
         run: |
@@ -56,7 +61,7 @@ jobs:
 
       - name: Upload findings
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: fp-findings
           path: fp-findings.json

.github/workflows/interface-fleet-audit.yml

@@ -22,9 +22,13 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: interface-fleet-audit-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   scanner-tests:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -41,7 +45,7 @@ jobs:
 
   fleet-audit:
     if: github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
     env:
       GITHUB_TOKEN: ${{ secrets.INTERFACE_FLEET_READ_TOKEN || github.token }}

.github/workflows/one-shot-runtime-env-test-patch.yml

@@ -8,6 +8,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: one-shot-runtime-env-test-patch-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   patch:
     runs-on: ubuntu-24.04

.github/workflows/ores-lint.yml

@@ -6,22 +6,35 @@ on:
   workflow_dispatch:
   # Add `push:` here once this repo's lint debt is paid down.
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ores-lint-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   lint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 1
+          show-progress: false
 
       - name: Detect project types
         id: detect
         run: |
           [ -f package.json ] && echo "js=true" >> "$GITHUB_OUTPUT" || echo "js=false" >> "$GITHUB_OUTPUT"
           [ -f Cargo.toml ]   && echo "rs=true" >> "$GITHUB_OUTPUT" || echo "rs=false" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         if: steps.detect.outputs.js == 'true'
         with:
           node-version: '22'
+          package-manager-cache: false
 
       # ESLint is a global tool here, not a repo dependency - so this job never
       # runs `npm install` and never needs the repo's node_modules.

.github/workflows/role-contract.yml

@@ -17,15 +17,15 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
+  contents: read
 
 concurrency:
   group: role-contract-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -39,14 +39,18 @@ jobs:
 
   branch-fixup:
     if: github.event_name == 'pull_request' && github.head_ref == 'feat/role-contract-fix'
+    permissions:
+      contents: write
     runs-on: ubuntu-24.04
     timeout-minutes: 30
+    env:
+      GH_TOKEN: ${{ github.token }}
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
           ref: feat/role-contract-fix
           fetch-depth: 0
-          persist-credentials: true
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
         with:
           toolchain: stable
@@ -67,6 +71,8 @@ jobs:
         run: cargo clippy --locked --all-targets -- -D warnings
       - name: Commit tested fixes and restore the permanent workflow
         run: |
+          set -euo pipefail
+          gh auth setup-git
           git fetch origin main --depth=1
           git show FETCH_HEAD:.github/workflows/role-contract.yml > .github/workflows/role-contract.yml
           rm -f .github/workflows/branch-fixup.yml tools/branch_fixup.py