Harden CI steps

.github/dependabot.yml

@@ -9,3 +9,5 @@ updates:
       interval: "weekly"
     # Disable @dependabot (except for security updates) because we use @renovate instead
     open-pull-requests-limit: 0
+    cooldown:
+      default-days: 7

.github/workflows/api-extractor.yml

@@ -1,6 +1,9 @@
 name: Api Extractor
 on: pull_request
 
+permissions:
+  contents: read
+
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
 jobs:
@@ -10,6 +13,8 @@ jobs:
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/arethetypeswrong.yml

@@ -7,13 +7,18 @@ on:
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
+permissions:
+  contents: read
+
 jobs:
   arethetypeswrong:
     name: Are the types wrong
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:

.github/workflows/change-prerelease-tag.yml

@@ -40,6 +40,7 @@ jobs:
           # Fetch entire git history so  Changesets can generate changelogs
           # with the correct commits
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/cleanup-checks.yml

@@ -5,9 +5,14 @@ on:
   pull_request_review:
     types: [submitted, edited]
 
+permissions: {}
+
 jobs:
   add_cleanup_label:
     # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#running-a-workflow-when-a-pull-request-is-approved
+    permissions:
+      contents: read
+      pull-requests: write
     if: |
       github.repository == 'apollographql/apollo-client' &&
       github.event.review.state == 'APPROVED' &&
@@ -17,6 +22,8 @@ jobs:
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - name: add label
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
@@ -25,13 +32,17 @@ jobs:
             await script.add_cleanup_label()
 
   cleanup:
+    permissions:
+      contents: write
     if: |
       github.repository == 'apollographql/apollo-client' &&
       contains(github.event.pull_request.labels.*.name, 'auto-cleanup')
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/compare-build-output.yml

@@ -4,6 +4,9 @@ on:
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
+permissions:
+  contents: read
+
 jobs:
   comparebuildoutput:
     name: Compare Build Output
@@ -14,6 +17,7 @@ jobs:
         with:
           # Fetch entire git history so we have the parent commit to compare against
           fetch-depth: 0
+          persist-credentials: false
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
@@ -23,6 +27,6 @@ jobs:
 
       - name: Run comparison script
         id: attw
-        run: ./config/compare-build-output-to.sh $(git merge-base HEAD origin/${{ github.base_ref }}) | tee $GITHUB_STEP_SUMMARY
+        run: ./config/compare-build-output-to.sh $(git merge-base HEAD origin/${GITHUB_BASE_REF}) | tee $GITHUB_STEP_SUMMARY
         env:
           RUNNER_TEMP: ${{ runner.temp }}

.github/workflows/copilot-setup-steps.yml

@@ -27,6 +27,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/docmodel.yml

@@ -3,13 +3,18 @@ name: Generate Documentation Model
 on:
   push:
 
+permissions:
+  contents: read
+
 jobs:
   docmodel:
     name: Generate Documentation Model
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/exit-prerelease.yml

@@ -35,6 +35,7 @@ jobs:
           # Fetch entire git history so  Changesets can generate changelogs
           # with the correct commits
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/knip.yml

@@ -2,12 +2,17 @@ name: Look for dead code and unused dependencies
 
 on: push
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
     name: Ubuntu/Node v20
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
       - name: Install dependencies (with cache)
         uses: bahmutov/npm-install@v1

.github/workflows/prerelease.yml

@@ -37,6 +37,7 @@ jobs:
           # Fetch entire git history so  Changesets can generate changelogs
           # with the correct commits
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Check for pre.json file existence
         id: check_files

.github/workflows/publish-pr-releases.yml

@@ -7,14 +7,22 @@ on:
       - "**"
     tags:
       - "!**"
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 jobs:
   prerelease:
     name: Pull Request Prerelease
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/release.yml

@@ -9,6 +9,8 @@
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
+permissions: {}
+
 jobs:
   release:
     name: Changesets Release
@@ -32,6 +34,7 @@
           # Fetch entire git history so  Changesets can generate changelogs
           # with the correct commits
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Check for pre.json file existence
         id: check_files
@@ -140,6 +143,8 @@
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
@@ -156,3 +161,22 @@
           if NEXT=$(npm show ${{ matrix.package.name }}@next version) node -e 'process.exit(require("semver").gt("${{ matrix.package.version }}",process.env.NEXT)?0:1)'; then
             npm dist-tag add ${{ matrix.package.name }}@${{ matrix.package.version }} next;
           fi
+
+  devtools-errorcodes:
+    name: Trigger Devtools Error Code Update
+    needs: release
+    if: needs.release.result == 'success' && needs.release.outputs.published == 'true'
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - uses: actions/create-github-app-token@v1
+        id: github-actions-bot-app-token
+        with:
+          app-id: 819772
+          private-key: ${{ secrets.APOLLO_GITHUB_ACTIONS_BOT_PRIVATE_KEY }}
+          repositories: apollo-client-devtools
+      - uses: benc-uk/workflow-dispatch@v1
+        with:
+          workflow: update-errorcodes.yml
+          repo: apollographql/apollo-client-devtools
+          token: ${{ steps.github-actions-bot-app-token.outputs.token }}

.github/workflows/scheduled-test-canary.yml

@@ -14,6 +14,9 @@ on:
         description: "React and React-DOM versions"
         required: true
         default: '["canary", "experimental"]'
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -26,12 +29,15 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           ref: ${{ matrix.branch }}
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ">=23.6.0"
       - uses: bahmutov/npm-install@v1
       - run: |
-          npm install react@${{ matrix.tag }} react-dom@${{ matrix.tag }}
+          npm install react@${MATRIX_TAG} react-dom@${MATRIX_TAG}
+        env:
+          MATRIX_TAG: ${{ matrix.tag }}
       # tests can be flaky, this runs only once a day and we want to minimize false negatives - retry up to three times
       - run: |
           node -e 'console.log("\n\nReact %s, React-DOM %s\n\n", require("react").version, require("react-dom").version)'

.github/workflows/size-limit.yml

@@ -8,9 +8,14 @@ on:
 jobs:
   size:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:

.github/workflows/sync-skill.yml

@@ -5,6 +5,8 @@ on:
     paths:
       - "docs/agent-skills/apollo-client/**"
   workflow_dispatch: # for testing
+permissions: {}
+
 jobs:
   dispatch:
     runs-on: ubuntu-latest

.github/workflows/zizmor.yml

@@ -0,0 +1,26 @@
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor 🌈
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
+      contents: read # Only needed for private repos. Needed to clone the repo.
+      actions: read # Only needed for private repos. Needed for upload-sarif to read workflow run info.
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3