Harden GitHub workflows against supply chain attacks

.github/dependabot.yml

@@ -0,0 +1,14 @@
+version: 2
+updates:
+  # Actions are pinned to commit SHAs; Dependabot keeps the SHAs (and their version comments) up to date
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    # Wait a few days before adopting a freshly published release (security updates are not delayed)
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/craftgate-build.yml

@@ -1,22 +1,27 @@
-name: Craftgate Node.js CI
+name: Build Craftgate Node.js Client
 
 on: [ push, pull_request ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build the Library
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Use Node.js version 12.x
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "12.x"
 
       - name: Install Dependencies
-        run: npm i
+        run: npm ci --ignore-scripts
 
       - name: Build the Library
         run: npm run build
@@ -29,14 +34,14 @@ jobs:
           .github/scripts/pack-artifacts.sh
 
       - name: Upload Artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: packed-library
           path: ${{ env.ARTIFACT_FILENAME }}
           if-no-files-found: error
 
       - name: Upload Runtime Check Script
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: runtime-check-script
           path: .github/scripts/check-runtime.js
@@ -52,7 +57,7 @@ jobs:
 
     steps:
       - name: Use Node.js version ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node-version }}
 
@@ -64,13 +69,13 @@ jobs:
           npm init -y
 
       - name: Download Packed Library
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: packed-library
           path: /home/runner/work/craftgate-node-client/check-runtime/
 
       - name: Download Runtime Check Script
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: runtime-check-script
           path: /home/runner/work/craftgate-node-client/check-runtime/
@@ -80,5 +85,5 @@ jobs:
         run: |
           ls -R
           FILENAME=$(ls *.tgz | tail -n 1)
-          npm i $FILENAME
+          npm i --ignore-scripts $FILENAME
           node check-runtime.js

.github/workflows/craftgate-release.yml

@@ -1,22 +1,80 @@
-name: Craftgate Node.js CI
+name: Release Craftgate Node.js Client
 
 on:
   release:
     types: [ published ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
+    name: Build the Library
     runs-on: ubuntu-latest
+
     steps:
-      - uses: actions/checkout@v4
-      # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '12.x'
+
+      - name: Install Dependencies
+        run: npm ci --ignore-scripts
+
+      - name: Set Version From Release Tag
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          VERSION="${RELEASE_TAG#v}"
+          if ! printf '%s' "$VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "::error::Release tag '$RELEASE_TAG' must be in the form X.Y.Z or vX.Y.Z"
+            exit 1
+          fi
+          npm version --allow-same-version --no-git-tag-version "$VERSION"
+
+      - name: Build the Library
+        run: npm run build
+
+      - name: Run Tests
+        run: npm run test
+
+      - name: Package Artifacts
+        run: |
+          .github/scripts/pack-artifacts.sh
+
+      - name: Upload Packed Library
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: packed-library
+          path: ${{ env.ARTIFACT_FILENAME }}
+          if-no-files-found: error
+
+  publish:
+    name: Publish to npm
+    runs-on: ubuntu-latest
+    needs: build
+    environment: npm-publish
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '24.x'
           registry-url: 'https://registry.npmjs.org'
-      - run: npm install
-      - run: npm version --allow-same-version --no-git-tag-version ${{github.event.release.tag_name}}
-      - run: npm run build
-      - run: npm publish --access public
+
+      - name: Download Packed Library
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: packed-library
+          path: ${{ runner.temp }}/packed-library
+
+
+      - name: Publish to npm
+        working-directory: ${{ runner.temp }}/packed-library
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish ./*.tgz --provenance --access public

.gitignore

@@ -5,4 +5,3 @@ coverage/
 .nyc_output/
 .DS_Store
 .idea/
-package-lock.json