From 18e4c79399d89895b4d91159163298a708c79374 Mon Sep 17 00:00:00 2001
From: lex00 <121451605+lex00@users.noreply.github.com>
Date: Mon, 10 Aug 2026 12:43:38 -0600
Subject: [PATCH] ci: harden docs.yml and release.yml from the chant audit
 (#287)

docs.yml: pin all four actions to full commit SHAs (GHA021/GHA029), move
the pages+id-token write grants from workflow-wide onto the deploy job
(GHA034), and give deploy a timeout-minutes (GHA022). release.yml: gate
the publish job behind an `environment: release` (GHA026) so protection
rules can be attached in repo settings, and the npm trusted-publisher
record can pin to it.

Closes #287

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JD1XEfzQByQEP29dMhJgvz
---
 .github/workflows/docs.yml    | 16 ++++++++++------
 .github/workflows/release.yml |  5 +++++
 2 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 4fe06c1..84f91c9 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -18,8 +18,6 @@ on:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 concurrency:
   group: pages
@@ -30,13 +28,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: '24'
       - run: npm install --prefix docs
       - run: npm run build --prefix docs
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
         with:
           path: docs/dist
 
@@ -46,9 +44,15 @@ jobs:
     if: github.event_name != 'pull_request'
     needs: build
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    # The write scopes live here, not workflow-wide: build (which runs on every
+    # PR) gets only contents: read.
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1691246..180fd23 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -31,6 +31,11 @@ jobs:
   release:
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    # Gates the OIDC exchange behind an environment, so protection rules
+    # (required reviewers, wait timers) can be attached in repo settings
+    # without touching this file. The npm trusted-publisher record can also
+    # name this environment to reject publishes from outside it.
+    environment: release
     permissions:
       # The OIDC token npm exchanges for a publish credential. `contents: read`
       # is inherited from the top; both are needed and neither is enough alone.