Merge pull request opf#498 from opf/code-maintenance/dream-689-investigate-github-actions-issues-discovered-by-zizmor-in-primer_view_components-repo

[DREAM-689] Investigate GitHub Actions issues discovered by zizmor in primer_view_components repo

Author: HDinger

.github/workflows/release.yml

@@ -21,8 +21,8 @@ jobs:
         uses: ruby/setup-ruby@6aaa311d81eba98ae12eaffbcb63296ace0efcde # v1
         with:
           ruby-version: "3.4"
-          bundler-cache: true
-      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+          bundler-cache: false
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5 # zizmor: ignore[cache-poisoning]
         with:
           node-version: 24
           cache: "npm"
@@ -36,17 +36,18 @@ jobs:
           chmod 0600 $HOME/.gem/credentials
         env:
           RUBYGEMS_TOKEN: ${{ secrets.RUBYGEMS_TOKEN_SHARED }}
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 # zizmor: ignore[cache-poisoning]
         with:
           node-version: 24
           registry-url: 'https://registry.npmjs.org'
+          cache: "npm"
       - name: NPM install
         run: |
           npm ci
       - name: Publish Gem
         run: bundle exec rake release
       - name: Publish NPM
-        run: npm publish --access public
+        run: npm publish --access public --provenance
 
   release-main:
     name: Main
@@ -64,7 +65,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 # zizmor: ignore[cache-poisoning]
         with:
           node-version: 24
           cache: "npm"
@@ -90,6 +91,8 @@ jobs:
           private-key: ${{ secrets.PRIMER_APP_PRIVATE_KEY_SHARED }}
           repositories: |
             primer_view_components
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Create release pull request or publish to npm
         id: changesets

.github/workflows/static-files.yml

@@ -21,9 +21,11 @@ jobs:
           private-key: ${{ secrets.PRIMER_APP_PRIVATE_KEY_SHARED }}
           owner: opf
           repositories: primer_view_components
+          permission-contents: write
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           token: ${{ steps.app-token.outputs.token }}
+          persist-credentials: false
       - uses: ruby/setup-ruby@6aaa311d81eba98ae12eaffbcb63296ace0efcde # v1
         with:
           ruby-version: '3.4'