Harden GitHub Actions workflows

[antonio-orionus]

Summary

• add a release quality gate before publishing
• scope workflow permissions to least privilege
• pin Bun and the Winget publisher action
• run the dependency vulnerability gate for all dependency PRs

Verification

• go run github.com/rhysd/actionlint/cmd/actionlint@latest -color=false
• bun run check

User-facing changes

• Release process now blocks publishing until a new pre-release quality gate passes (runs bun install --frozen-lockfile and bun run check), reducing the chance of releasing broken or unverified artifacts.
• Dependency vulnerability scanning (bun audit) is applied to all dependency PRs (not just Dependabot), so users should see broader blocking on high+ advisories.

Internal / refactor changes

• Workflow permissions hardened: default workflows set minimum permissions (contents: read) and publish/release jobs explicitly request write where needed.
• Credentials persistence disabled in PR runs (checkout: persist-credentials: false) to avoid leaking tokens.
• Bun toolchain pinned via workflow-level BUN_VERSION (used across CI, deps-vuln-gate, e2e-cold-start, installer-smoke, release).
• Release workflow restructured: new quality-gate job added and prepare-release now depends on it.
• Winget publisher action pinned from tracking main to a fixed commit SHA.
• Minor CI workflow edits to use the pinned BUN_VERSION env variable.

Risk areas

• Release/job ordering: the added quality-gate changes release job dependencies — verify artifact propagation, job concurrency, and that downstream jobs still run when expected.
• Build/tooling: pinning Bun (1.2.23) prevents automatic updates; failures may occur if the pinned version becomes incompatible with code or other actions.
• Publisher action pinning: winget-releaser pinned to a specific commit removes automatic upstream fixes/security patches — monitor upstream for updates.
• Permissions tightening: some jobs may fail due to insufficient permissions if any required scopes were omitted; ensure write scopes are granted only where necessary.
• IPC/Electron considerations: no source code changes here, but verify release artifacts used by Electron packaging (if applicable) are still produced and signed as expected under the new pipeline.
• Dependency gating: expanding bun audit to all dependency PRs may block merges more frequently; confirm expected thresholds and false positives.

Tests / checks to run

• actionlint: go run github.com/rhysd/actionlint/cmd/actionlint@latest -color=false
• Local CI checks: bun run check (already added to quality gate)
• Verify workflows in a dry run or test branch:
  • Trigger dependency PRs from non-Dependabot sources to confirm deps-vuln-gate runs.
  • Run release workflow end-to-end (or simulated) to confirm quality-gate blocks or permits publish as intended and that artifacts propagate to publish jobs.
  • Run Windows installer smoke tests and e2e cold-start suites with pinned Bun.
• Confirm no jobs fail due to permission changes and that persist-credentials: false does not break required checkout/auth flows.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 4cb561ac-db04-4db2-9e17-96cc347e955e

📥 Commits

Reviewing files that changed from the base of the PR and between 8685ec2 and eec314c.

📒 Files selected for processing (5)

• .github/workflows/ci.yml
• .github/workflows/deps-vuln-gate.yml
• .github/workflows/e2e-cold-start.yml
• .github/workflows/flatpak.yml
• .github/workflows/installer-smoke.yml

📜 Recent review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (7)

• GitHub Check: Cold start (windows)
• GitHub Check: Cold start (linux)
• GitHub Check: Cold start (macos-arm64)
• GitHub Check: check
• GitHub Check: Build Windows installer
• GitHub Check: build
• GitHub Check: check

🧰 Additional context used

📓 Path-based instructions (1)

.github/workflows/**

⚙️ CodeRabbit configuration file

Review GitHub Actions for least-privilege permissions, unsafe secret exposure, untrusted PR execution, shell quoting, release/tag correctness, artifact handling, and whether commands can fail silently.

Files:

• .github/workflows/flatpak.yml
• .github/workflows/deps-vuln-gate.yml
• .github/workflows/e2e-cold-start.yml
• .github/workflows/ci.yml
• .github/workflows/installer-smoke.yml

🔇 Additional comments (5)

.github/workflows/ci.yml (1)

26-27: LGTM!

.github/workflows/deps-vuln-gate.yml (1)

26-27: LGTM!

.github/workflows/e2e-cold-start.yml (1)

43-44: LGTM!

.github/workflows/flatpak.yml (1)

31-31: LGTM!

.github/workflows/installer-smoke.yml (1)

39-40: LGTM!

---

📝 Walkthrough

Walkthrough

This PR standardizes Bun version management across CI/CD workflows by introducing a pinned BUN_VERSION environment variable used in place of latest, adds explicit least-privilege permission blocks to restrict GitHub token access, introduces a quality-gate job in the release workflow, and pins the Winget releaser action to a specific commit.

Changes

CI/CD Hardening and Bun Standardization

Layer / File(s)	Summary
Bun version pinning across standard CI workflows .github/workflows/ci.yml, .github/workflows/deps-vuln-gate.yml, .github/workflows/e2e-cold-start.yml, .github/workflows/installer-smoke.yml, .github/workflows/flatpak.yml	Introduces pinned BUN_VERSION environment variable and updates Bun setup to use it instead of latest. Also tightens workflow permissions to contents: read, updates checkout steps to persist-credentials: false, and removes the Dependabot-only condition from the dependency vulnerability gate.
Release workflow quality gate and permissions .github/workflows/release.yml	Adds BUN_VERSION pinning to release.yml, introduces a new quality-gate job that runs bun install --frozen-lockfile and bun run check, updates prepare-release to depend on the quality gate, and adds explicit contents: write permissions to build, finalize, and upload-flatpak jobs.
Winget release security hardening .github/workflows/release_to_winget.yml	Adds explicit least-privilege permissions: { contents: read } and pins vedantmgoyal9/winget-releaser action to a specific commit SHA instead of main.

---

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

---

Suggested labels

github_actions, dependencies

🚥 Pre-merge checks | ✅ 3 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description covers the key changes, but is missing several required template sections including Base branch confirmation, Type selection, and Checks verification.	Add the missing required sections: confirm Base branch targeting, select the PR Type, and check all required verification checks.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Harden GitHub Actions workflows' directly summarizes the main change, clearly indicating the purpose of the PR across all modified workflow files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/workflow-hardening

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/deps-vuln-gate.yml:
- Line 25: The checkout step currently uses actions/checkout@v6 without
disabling credential persistence; update the checkout invocation(s)
(actions/checkout@v6) in this workflow (and any other workflows that run
untrusted PR code) to set persist-credentials: false so the GITHUB_TOKEN is not
written into .git/config and untrusted lifecycle scripts cannot use repo
credentials.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 53abed0e-656c-4daa-9556-347ae92cc73e

📥 Commits

Reviewing files that changed from the base of the PR and between abae7ec and 8685ec2.

📒 Files selected for processing (6)

• .github/workflows/ci.yml
• .github/workflows/deps-vuln-gate.yml
• .github/workflows/e2e-cold-start.yml
• .github/workflows/installer-smoke.yml
• .github/workflows/release.yml
• .github/workflows/release_to_winget.yml

📜 Review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (6)

• GitHub Check: check
• GitHub Check: check
• GitHub Check: Build Windows installer
• GitHub Check: Cold start (windows)
• GitHub Check: Cold start (linux)
• GitHub Check: Cold start (macos-arm64)

🧰 Additional context used

📓 Path-based instructions (1)

.github/workflows/**

⚙️ CodeRabbit configuration file

Review GitHub Actions for least-privilege permissions, unsafe secret exposure, untrusted PR execution, shell quoting, release/tag correctness, artifact handling, and whether commands can fail silently.

Files:

• .github/workflows/release_to_winget.yml
• .github/workflows/e2e-cold-start.yml
• .github/workflows/ci.yml
• .github/workflows/installer-smoke.yml
• .github/workflows/release.yml
• .github/workflows/deps-vuln-gate.yml

🪛 zizmor (1.25.2)

.github/workflows/release.yml

[warning] 51-51: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

---

[error] 51-51: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

---

[error] 53-53: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

---

[error] 57-57: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

---

[error] 53-53: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default

(cache-poisoning)

---

[error] 57-57: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default

(cache-poisoning)

---

[info] 47-47: workflow or action definition without a name (anonymous-definition): this job

(anonymous-definition)

---

[warning] 103-103: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment

(undocumented-permissions)

---

[warning] 128-128: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment

(undocumented-permissions)

---

[warning] 273-273: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment

(undocumented-permissions)

.github/workflows/deps-vuln-gate.yml

[warning] 25-25: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

---

[error] 25-25: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

---

[error] 27-27: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

---

[info] 22-22: workflow or action definition without a name (anonymous-definition): this job

(anonymous-definition)

🔇 Additional comments (9)

.github/workflows/release.yml (3)

7-12: LGTM!

---

47-65: LGTM!

Also applies to: 79-79

---

102-103: LGTM!

Also applies to: 116-116, 127-128, 272-273

.github/workflows/release_to_winget.yml (2)

11-12: LGTM!

---

29-29: ⚡ Quick win

Update traceability for pinned winget-releaser SHA

• In .github/workflows/release_to_winget.yml:29, the pinned commit vedantmgoyal9/winget-releaser@7bd472be23763def6e16bd06cc8b1cdfab0e2fd5 exists (commit message: docs: add description to inputs (#335)), but the /tags lookup shows no tag pointing directly to that exact SHA.
• Confirm which published winget-releaser release/version this commit corresponds to (e.g., via GitHub Releases metadata), then add an inline # vX.Y.Z (or an equivalent traceable version reference if no direct tag exists).

.github/workflows/ci.yml (1)

15-18: LGTM!

Also applies to: 33-33

.github/workflows/deps-vuln-gate.yml (1)

18-20: LGTM!

.github/workflows/e2e-cold-start.yml (1)

16-19: LGTM!

Also applies to: 46-46

.github/workflows/installer-smoke.yml (1)

28-31: LGTM! Workflow-level contents: read with the publish job scoping up to contents: write is correct least-privilege.

Also applies to: 41-41