security: harden GitHub Actions workflows against credential exposure and fork PR attacks

Author: Yermanaco

.github/workflows/ChatGPT-Reviewer.yml

@@ -17,7 +17,7 @@ jobs:
     steps:
       - uses: platisd/openai-pr-description@master
         with:
-          github_token: ${{ secrets.NOVUM_PRIVATE_REPOS }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
           openai_api_key: ${{ secrets.OPENAI_API_KEY }}
           sample_prompt: |
             You are a design system designer and your function is create a table with all the changes for a GitHub Pull Request in Markdown format.

.github/workflows/auto-generator.yml

@@ -1,5 +1,8 @@
 name: Readme Generator
 
+permissions:
+  contents: write
+
 on:
   workflow_dispatch:
   push:
@@ -20,7 +23,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Get branch name
         uses: rlespinasse/github-slug-action@v3.x

.github/workflows/evenodd-test.yml

@@ -1,5 +1,8 @@
 name: Check evenodds
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   # push:
@@ -17,7 +20,9 @@ jobs:
 
     steps:
       - name: Checkout del código
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Search for evenodd icons
         run: |

.github/workflows/figma-export.yml

@@ -1,5 +1,9 @@
 name: 🚀 Release (Figma)
 
+permissions:
+  contents: write
+  pull-requests: write
+
 on:
   workflow_dispatch:
     inputs:
@@ -36,7 +40,9 @@ jobs:
   export-icons:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Install SVG/PDF tooling
         run: |
@@ -138,7 +144,7 @@ jobs:
       - name: Commit & Push
         if: ${{ steps.changes.outputs.changed == 'true' }}
         env:
-          GITHUB_TOKEN: ${{ secrets.NOVUM_PRIVATE_REPOS }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TARGET_BRANCH: ${{ github.event.inputs.branch || 'import-figma-icons' }}
         run: |
           git config user.name "github-actions"
@@ -156,4 +162,4 @@ jobs:
           pr_title: ${{ steps.pr.outputs.title }}
           pr_body: ${{ steps.pr.outputs.body }}
           pr_draft: ${{ github.event.inputs.draft }}
-          github_token: ${{ secrets.NOVUM_PRIVATE_REPOS }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/icons-release.yml

@@ -1,5 +1,8 @@
 name: Publish Release
 
+permissions:
+  contents: write
+
 on:
   pull_request:
     types: [closed]
@@ -14,7 +17,9 @@ jobs:
     if: github.event.pull_request.merged
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Create a Release
         uses: elgohr/Github-Release-Action@v4
         env:

.github/workflows/keywords-test.yml

@@ -1,5 +1,8 @@
 name: Check icons keywords
 
+permissions:
+  contents: write
+
 on:
   workflow_dispatch:
   # push:
@@ -17,7 +20,9 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: List SVG files
         run: |
@@ -88,7 +93,9 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: List SVG files
         run: |
@@ -164,9 +171,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
         with:
-          token: ${{ secrets.NOVUM_PRIVATE_REPOS }}
+          persist-credentials: false
+          token: ${{ secrets.GITHUB_TOKEN }}
           ref: ${{ github.head_ref }}
 
       - name: Set up Python
@@ -192,7 +200,7 @@ jobs:
 
       - name: Commit & Push
         env:
-          GITHUB_TOKEN: ${{ secrets.NOVUM_PRIVATE_REPOS }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           git config user.name "github-actions"
           git config user.email "github-actions[bot]@users.noreply.github.com"
@@ -232,7 +240,9 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: List SVG files
         run: |