ci: harden GitHub Actions checkout

.github/dependabot.yml

@@ -4,6 +4,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     groups:
       kubernetes:
         patterns:
@@ -17,6 +19,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     groups:
       actions:
         patterns:
@@ -26,3 +30,5 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/lint-helm.yml

@@ -11,15 +11,21 @@ on:
       - 'Makefile'
       - '.github/workflows/lint-helm.yml'
 
+permissions: {}
+
 env:
   HELM_CHART_PATH: charts/lifecycle-controller
 
 jobs:
   lint:
+    permissions:
+      contents: read
     name: Helm lint
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Read Helm version from .Version
         id: get-helm-version

.github/workflows/lint.yml

@@ -13,12 +13,18 @@ on:
       - '.golangci.yml'
       - '.github/workflows/lint.yml'
 
+permissions: {}
+
 jobs:
   lint:
+    permissions:
+      contents: read
     name: Go lint
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:

.github/workflows/release-helm.yml

@@ -13,6 +13,8 @@ on:
       - '.github/workflows/release-helm.yml'
   workflow_dispatch:
 
+permissions: {}
+
 env:
   HELM_CHART_PATH: charts/lifecycle-controller
 
@@ -27,6 +29,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Configure Git
         run: |

.github/workflows/release.yml

@@ -9,21 +9,24 @@ on:
     tags:
       - 'v[0-9]+.[0-9]+.[0-9]+'
 
+permissions: {}
+
 jobs:
   goreleaser:
     runs-on: ubuntu-latest
     permissions:
       contents: write
       packages: write
-      id-token: write
 
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
+          cache: false
           go-version-file: go.mod
 
       - run: go version
@@ -32,6 +35,11 @@ jobs:
 
       - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
 
+      - name: Verify Docker builder
+        run: |
+          docker buildx version
+          docker buildx inspect --bootstrap
+
       - name: Log in to GitHub Container Registry
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
         with:

.github/workflows/test-e2e-helm.yml

@@ -14,15 +14,21 @@ on:
       - 'go.sum'
       - '.github/workflows/test-e2e-helm.yml'
 
+permissions: {}
+
 env:
   HELM_CHART_PATH: charts/lifecycle-controller
 
 jobs:
   test-e2e-helm:
+    permissions:
+      contents: read
     name: Helm E2E tests
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:

.github/workflows/test-e2e.yml

@@ -20,12 +20,18 @@ on:
       - 'test/utils/**'
       - '.github/workflows/test-e2e.yml'
 
+permissions: {}
+
 jobs:
   test-e2e:
+    permissions:
+      contents: read
     name: E2E tests
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:

.github/workflows/test-helm-unittest.yml

@@ -11,15 +11,21 @@ on:
       - 'Makefile'
       - '.github/workflows/test-helm-unittest.yml'
 
+permissions: {}
+
 env:
   HELM_CHART_PATH: charts/lifecycle-controller
 
 jobs:
   helm-unittest:
+    permissions:
+      contents: read
     name: Helm unit tests
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Read Helm version from .Version
         id: get-helm-version

.github/workflows/test-helm.yml

@@ -11,15 +11,21 @@ on:
       - 'Makefile'
       - '.github/workflows/test-helm.yml'
 
+permissions: {}
+
 env:
   HELM_CHART_PATH: charts/lifecycle-controller
 
 jobs:
   template-test:
+    permissions:
+      contents: read
     name: Helm template
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Read Helm version from .Version
         id: get-helm-version

.github/workflows/test.yml

@@ -12,12 +12,18 @@ on:
       - 'go.sum'
       - '.github/workflows/test.yml'
 
+permissions: {}
+
 jobs:
   test:
+    permissions:
+      contents: read
     name: Unit tests
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:

.github/workflows/zizmor.yml

@@ -0,0 +1,41 @@
+name: GitHub Configuration Security
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+    paths:
+      - '.github/**'
+  push:
+    branches:
+      - main
+    paths:
+      - '.github/**'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Audit GitHub Configuration
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Audit workflows
+        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
+        with:
+          advanced-security: false
+          inputs: .github
+          version: v1.27.0