🌱 harden git workflows

.github/workflows/code-scanning.yaml

@@ -28,6 +28,8 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@v7
+      with:
+        persist-credentials: false
 
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v4

.github/workflows/config-checks.yaml

@@ -18,13 +18,18 @@ on:
   workflow_call:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   helm-lint:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Install Helm
         uses: azure/setup-helm@v5.0.0
         id: install
@@ -36,6 +41,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Get Golang version
         id: vars
         run: |
@@ -53,6 +60,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Get Golang version
         id: vars
         run: |
@@ -63,4 +72,3 @@ jobs:
         with:
           go-version: ${{ env.GOLANG_VERSION }}
       - run: make validate-helm-values
-

.github/workflows/coverage.yaml

@@ -29,6 +29,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Get Golang version
         id: vars
         run: |

.github/workflows/e2e-tests.yaml

@@ -82,6 +82,8 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         name: Check out code
+        with:
+          persist-credentials: false
       - name: Download values override file
         if: ${{ inputs.use_values_override }}
         uses: actions/download-artifact@v8
@@ -148,6 +150,8 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         name: Check out code
+        with:
+          persist-credentials: false
       - name: Download values override file
         if: ${{ inputs.use_values_override }}
         uses: actions/download-artifact@v8

.github/workflows/forward-compatibility.yaml

@@ -33,33 +33,35 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v7
-
+        with:
+          persist-credentials: false
+
       - name: Install regctl
         uses: regclient/actions/regctl-installer@148669fe4b19151fcab6e00c6df2db43b9e2b097
         with:
           release: v0.11.3
-      
+
       - name: Get latest component images and generate values override file
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           # Fetch latest images from component repositories
           echo "::notice::Fetching latest container-toolkit image..."
           TOOLKIT=$(.github/scripts/get-latest-images.sh toolkit)
-          
+
           echo "::notice::Fetching latest device-plugin image..."
           DEVICE_PLUGIN=$(.github/scripts/get-latest-images.sh device-plugin)
-          
+
           echo "::notice::Fetching latest mig-manager image..."
           MIG_MANAGER=$(.github/scripts/get-latest-images.sh mig-manager)
-          
+
           # Generate values override file
           .github/scripts/generate-values-overrides.sh \
             values-overrides.yaml \
             "${TOOLKIT}" \
             "${DEVICE_PLUGIN}" \
             "${MIG_MANAGER}"
-      
+
       - name: Upload values override file
         uses: actions/upload-artifact@v7
         with:

.github/workflows/golang-checks.yaml

@@ -28,6 +28,8 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         name: Checkout code
+        with:
+          persist-credentials: false
       - name: Get Golang version
         id: vars
         run: |
@@ -63,6 +65,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Get Golang version
         id: vars
         run: |
@@ -89,4 +93,6 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         name: Checkout code
+        with:
+          persist-credentials: false
       - run: make docker-build

.github/workflows/image-builds.yaml

@@ -86,6 +86,8 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         name: Check out code
+        with:
+          persist-credentials: false
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v4
         with:
@@ -118,6 +120,8 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         name: Check out code
+        with:
+          persist-credentials: false
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v4
         with:
@@ -146,6 +150,8 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         name: Check out code
+        with:
+          persist-credentials: false
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v4
         with:
@@ -163,4 +169,3 @@ jobs:
             ${OPERATOR_IMAGE_AMD} \
             ${OPERATOR_IMAGE_ARM}
           docker manifest push ${OPERATOR_MULTIARCH_IMAGE}
-

.github/workflows/publish-helm-oci-chart.yaml

@@ -39,6 +39,8 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         name: Check out code
+        with:
+          persist-credentials: false
 
       - name: Set up Helm
         uses: azure/setup-helm@v5.0.0

.github/workflows/release-image-list.yaml

@@ -34,6 +34,7 @@ jobs:
         name: Check out code
         with:
           ref: ${{ github.event.release.tag_name }}
+          persist-credentials: false
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
@@ -66,6 +67,8 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         name: Check out code
+        with:
+          persist-credentials: false
       - name: Download image list artifact
         uses: actions/download-artifact@v8
         with:

.github/workflows/release.yaml

@@ -68,6 +68,8 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         name: Check out code
+        with:
+          persist-credentials: false
       - name: Install regctl
         uses: regclient/actions/regctl-installer@148669fe4b19151fcab6e00c6df2db43b9e2b097
         with:
@@ -91,6 +93,8 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         name: Check out code
+        with:
+          persist-credentials: false
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v4
         with:
@@ -114,4 +118,3 @@ jobs:
           BUNDLE_IMAGE_BASE="ghcr.io/nvidia/gpu-operator/gpu-operator-bundle"
           make push-bundle-image BUNDLE_IMAGE=${BUNDLE_IMAGE_BASE}:${{ github.ref_name }}-latest
           make push-bundle-image BUNDLE_IMAGE=${BUNDLE_IMAGE_BASE}:${COMMIT_SHORT_SHA}
-

.github/workflows/stale.yaml

@@ -5,12 +5,15 @@ on:
   schedule:
     - cron: "21 4 * * *"
 
+permissions: {}
+
 jobs:
   stale:
     permissions:
       actions: write
       issues: write
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - uses: actions/stale@v10