Harden GitHub Actions workflows

.github/workflows/build-objects.yml

@@ -4,16 +4,32 @@ on:
   pull_request_target:
     types: [opened, synchronize, reopened]
 
+# Only what actions/checkout needs. On a public repo this grants nothing an
+# anonymous clone doesn't already have, and it stops a job that executes
+# contributor-authored build scripts from being able to write to the repo.
+permissions:
+  contents: read
+
 jobs:
+  # Untrusted: pull_request_target runs with the base repo's secrets, and the
+  # build executes scripts from the PR branch. The pr-build environment holds
+  # this until a maintainer approves the run, which is tied to the head SHA, so
+  # every push to the PR is re-approved.
   build-objects:
     if: github.repository_owner == 'theonlyzac'
     runs-on: ubuntu-latest
+    environment: pr-build
+    concurrency:
+      group: build-objects-${{ github.event.pull_request.number }}
+      cancel-in-progress: true
 
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: false
+          allow-unsafe-pr-checkout: true
 
       - name: Setup build environment
         run: scripts/quickstart.sh

.github/workflows/build.yml

@@ -7,15 +7,49 @@ on:
   pull_request_target:
     types: [opened, synchronize, reopened]
 
+# Only what actions/checkout needs. On a public repo this grants nothing an
+# anonymous clone doesn't already have, and it stops a job that executes
+# contributor-authored build scripts from being able to write to the repo.
+permissions:
+  contents: read
+
 jobs:
-  build:
-    if: github.repository_owner == 'theonlyzac'
+  # Trusted: the code being built is already on main.
+  build-main:
+    if: github.event_name == 'push' && github.repository_owner == 'theonlyzac'
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Setup build environment
+        run: |
+          scripts/quickstart.sh
+          curl -o disc/SCUS_971.98 "${{ secrets.FILE_URL }}"
+
+      - name: Run build script
+        run: scripts/build.sh
+
+  # Untrusted: pull_request_target runs with the base repo's secrets, and the
+  # build executes scripts from the PR branch. The pr-build environment holds
+  # this until a maintainer approves the run, which is tied to the head SHA, so
+  # every push to the PR is re-approved.
+  build-pr:
+    if: github.event_name == 'pull_request_target' && github.repository_owner == 'theonlyzac'
     runs-on: ubuntu-latest
+    environment: pr-build
+    concurrency:
+      group: build-pr-${{ github.event.pull_request.number }}
+      cancel-in-progress: true
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: false
+          allow-unsafe-pr-checkout: true
 
       - name: Setup build environment
         run: |