Harden manual race workflow

Author: dzarlax

.github/workflows/ci.yml

@@ -59,10 +59,14 @@ jobs:
     name: Race Detector
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'workflow_dispatch' && inputs.run_race }}
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
           cache: true
@@ -115,7 +119,7 @@ jobs:
     name: Docker Build & Push (arm64)
     needs: build
     runs-on: ubuntu-latest
-    if: ${{ github.event_name == 'workflow_dispatch' && inputs.build_arm64 && !inputs.run_race }}
+    if: ${{ github.ref == 'refs/heads/main' && github.event_name == 'workflow_dispatch' && inputs.build_arm64 && !inputs.run_race }}
     permissions:
       contents: read
       packages: write

docs/ai-plans/2026-06-06-issue-152-ci-race-detector-branch-protection-policy.html

@@ -133,7 +133,8 @@ <h2>Implementation Result</h2>
       <li>Kept the default <code>Build, Vet &amp; Test</code> job name stable.</li>
       <li>Added a manual-only <code>Race Detector</code> job behind <code>workflow_dispatch</code> input <code>run_race=true</code>.</li>
       <li>Race detector job runs <code>CGO_ENABLED=1 go test -race ./...</code> and is not required on normal PR or push runs.</li>
-      <li>Guarded Docker publish jobs so race-only dispatches do not push images when <code>run_race=true</code>.</li>
+      <li>Guarded Docker publish jobs so race-only dispatches do not push images when <code>run_race=true</code>, and so arm64 image publishing is limited to <code>main</code>.</li>
+      <li>Hardened the manual race job with <code>permissions: contents: read</code>, <code>persist-credentials: false</code>, and SHA-pinned checkout/setup-go actions.</li>
       <li>Documented local and CI race-detector guidance in <code>CONTRIBUTING.md</code>.</li>
       <li>Recorded current branch protection state: GitHub API returned <code>Branch not protected</code> for <code>main</code> on 2026-06-06.</li>
     </ul>
@@ -146,6 +147,7 @@ <h2>Verification Run</h2>
       <li><code>go vet ./...</code></li>
       <li><code>CGO_ENABLED=1 go test -race ./...</code> on Windows was blocked before tests by missing <code>gcc</code> in <code>PATH</code>; the manual GitHub Actions job is the Ubuntu validation path.</li>
       <li>Manual GitHub Actions run <code>27062004434</code> passed with <code>run_race=true</code>, including the <code>Race Detector</code> job on Ubuntu.</li>
+      <li>Manual GitHub Actions run <code>27062164558</code> passed with <code>build_amd64=true</code>, <code>build_arm64=true</code>, and <code>run_race=true</code>; race detector passed and both Docker publish jobs were skipped.</li>
       <li><code>gh api repos/Dzarlax-AI/health_dashboard/branches/main/protection</code> returned <code>404 Branch not protected</code>.</li>
     </ul>
   </section>