Harden CI steps

.github/dependabot.yml

@@ -9,3 +9,5 @@ updates:
       interval: "weekly"
     # Disable @dependabot (except for security updates) because we use @renovate instead
     open-pull-requests-limit: 0
+    cooldown:
+      default-days: 7

.github/workflows/api-extractor.yml

@@ -1,6 +1,9 @@
 name: Api Extractor
 on: pull_request
 
+permissions:
+  contents: read
+
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
 jobs:
@@ -10,14 +13,16 @@ jobs:
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ">=23.6.0"
 
       - name: Install dependencies (with cache)
-        uses: bahmutov/npm-install@v1
+        uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb #v1
 
         # Builds the library and runs the api extractor
       - name: Run Api-Extractor

.github/workflows/arethetypeswrong.yml

@@ -7,19 +7,24 @@ on:
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
+permissions:
+  contents: read
+
 jobs:
   arethetypeswrong:
     name: Are the types wrong
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ">=23.6.0"
       - name: Install dependencies (with cache)
-        uses: bahmutov/npm-install@v1
+        uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb #v1
 
       - name: Run build
         run: npm run build

.github/workflows/change-prerelease-tag.yml

@@ -40,6 +40,8 @@ jobs:
           # Fetch entire git history so  Changesets can generate changelogs
           # with the correct commits
           fetch-depth: 0
+          # We want to commit back further down.
+          persist-credentials: true
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/cleanup-checks.yml

@@ -5,9 +5,14 @@ on:
   pull_request_review:
     types: [submitted, edited]
 
+permissions: {}
+
 jobs:
   add_cleanup_label:
     # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#running-a-workflow-when-a-pull-request-is-approved
+    permissions:
+      contents: read
+      pull-requests: write
     if: |
       github.repository == 'apollographql/apollo-client' &&
       github.event.review.state == 'APPROVED' &&
@@ -17,6 +22,8 @@ jobs:
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - name: add label
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
@@ -25,21 +32,25 @@ jobs:
             await script.add_cleanup_label()
 
   cleanup:
+    permissions:
+      contents: write
     if: |
       github.repository == 'apollographql/apollo-client' &&
       contains(github.event.pull_request.labels.*.name, 'auto-cleanup')
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ">=23.6.0"
 
       - name: Install dependencies (with cache)
-        uses: bahmutov/npm-install@v1
+        uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb #v1
 
       - name: Run Api-Extractor
         run: npm run extract-api

.github/workflows/compare-build-output.yml

@@ -4,6 +4,9 @@ on:
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
+permissions:
+  contents: read
+
 jobs:
   comparebuildoutput:
     name: Compare Build Output
@@ -14,15 +17,16 @@ jobs:
         with:
           # Fetch entire git history so we have the parent commit to compare against
           fetch-depth: 0
+          persist-credentials: false
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ">=23.6.0"
       - name: Install dependencies (with cache)
-        uses: bahmutov/npm-install@v1
+        uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb #v1
 
       - name: Run comparison script
         id: attw
-        run: ./config/compare-build-output-to.sh $(git merge-base HEAD origin/${{ github.base_ref }}) | tee $GITHUB_STEP_SUMMARY
+        run: ./config/compare-build-output-to.sh $(git merge-base HEAD origin/${GITHUB_BASE_REF}) | tee $GITHUB_STEP_SUMMARY
         env:
           RUNNER_TEMP: ${{ runner.temp }}

.github/workflows/copilot-setup-steps.yml

@@ -27,6 +27,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/docmodel.yml

@@ -3,21 +3,26 @@ name: Generate Documentation Model
 on:
   push:
 
+permissions:
+  contents: read
+
 jobs:
   docmodel:
     name: Generate Documentation Model
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ">=23.6.0"
 
       - name: Install dependencies (with cache)
-        uses: bahmutov/npm-install@v1
+        uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb #v1
 
       - name: Generate documentation model
         run: npm run docmodel

.github/workflows/exit-prerelease.yml

@@ -35,6 +35,8 @@ jobs:
           # Fetch entire git history so  Changesets can generate changelogs
           # with the correct commits
           fetch-depth: 0
+          # We want to commit back further down.
+          persist-credentials: true
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/knip.yml

@@ -2,14 +2,19 @@ name: Look for dead code and unused dependencies
 
 on: push
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
     name: Ubuntu/Node v20
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
       - name: Install dependencies (with cache)
-        uses: bahmutov/npm-install@v1
+        uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb #v1
       - name: Run knip
         run: npm run knip

.github/workflows/prerelease.yml

@@ -22,7 +22,7 @@
       pull-requests: write
       id-token: write
     steps:
-      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v1
+      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3
         id: github-actions-bot-app-token
         with:
           app-id: 819772
@@ -37,6 +37,7 @@
           # Fetch entire git history so  Changesets can generate changelogs
           # with the correct commits
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Check for pre.json file existence
         id: check_files

.github/workflows/publish-pr-releases.yml

@@ -7,19 +7,28 @@ on:
       - "**"
     tags:
       - "!**"
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 jobs:
   prerelease:
     name: Pull Request Prerelease
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ">=23.6.0"
+          package-manager-cache: false
 
       - name: Check if any files in codegen/ changed
         id: changed-files-codegen
@@ -34,7 +43,7 @@ jobs:
           file-filter: "scripts/codemods/ac3-to-ac4/**"
 
       - name: Install dependencies with cache
-        uses: bahmutov/npm-install@v1
+        uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb #v1
 
       - name: Build AC
         run: npm run build

.github/workflows/release.yml

@@ -9,6 +9,8 @@
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
+permissions: {}
+
 jobs:
   release:
     name: Changesets Release
@@ -32,6 +34,7 @@
           # Fetch entire git history so  Changesets can generate changelogs
           # with the correct commits
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Check for pre.json file existence
         id: check_files
@@ -140,6 +143,8 @@
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
@@ -156,3 +161,22 @@
           if NEXT=$(npm show ${{ matrix.package.name }}@next version) node -e 'process.exit(require("semver").gt("${{ matrix.package.version }}",process.env.NEXT)?0:1)'; then
             npm dist-tag add ${{ matrix.package.name }}@${{ matrix.package.version }} next;
           fi
+
+  devtools-errorcodes:
+    name: Trigger Devtools Error Code Update
+    needs: release
+    if: needs.release.result == 'success' && needs.release.outputs.published == 'true'
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 #v3
+        id: github-actions-bot-app-token
+        with:
+          app-id: 819772
+          private-key: ${{ secrets.APOLLO_GITHUB_ACTIONS_BOT_PRIVATE_KEY }}
+          repositories: apollo-client-devtools
+      - uses: benc-uk/workflow-dispatch@7a027648b88c2413826b6ddd6c76114894dc5ec4 #v1
+        with:
+          workflow: update-errorcodes.yml
+          repo: apollographql/apollo-client-devtools
+          token: ${{ steps.github-actions-bot-app-token.outputs.token }}

.github/workflows/scheduled-test-canary.yml

@@ -14,6 +14,9 @@ on:
         description: "React and React-DOM versions"
         required: true
         default: '["canary", "experimental"]'
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -26,12 +29,15 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           ref: ${{ matrix.branch }}
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ">=23.6.0"
-      - uses: bahmutov/npm-install@v1
+      - uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb #v1
       - run: |
-          npm install react@${{ matrix.tag }} react-dom@${{ matrix.tag }}
+          npm install react@${MATRIX_TAG} react-dom@${MATRIX_TAG}
+        env:
+          MATRIX_TAG: ${{ matrix.tag }}
       # tests can be flaky, this runs only once a day and we want to minimize false negatives - retry up to three times
       - run: |
           node -e 'console.log("\n\nReact %s, React-DOM %s\n\n", require("react").version, require("react-dom").version)'

.github/workflows/size-limit.yml

@@ -8,15 +8,20 @@ on:
 jobs:
   size:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ">=23.6.0"
       - name: Install dependencies (with cache)
-        uses: bahmutov/npm-install@v1
+        uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb #v1
       - name: Run size-limit
         uses: andresz1/size-limit-action@e7493a72a44b113341c0cf6186ab49c17c4b65c1 # v1
         with: