fix: publish a valid consumer baseline pin

Author: relotnek

.github/workflows/consumer-alpha-canary.yml

@@ -18,7 +18,7 @@ jobs:
     permissions:
       actions: read
       contents: read
-    uses: filecoin-project/ff-sec-actions/.github/workflows/ecosystem-baseline.yml@24d5c70f87a771b3d3432efd12316f4e29251465
+    uses: filecoin-project/ff-sec-actions/.github/workflows/ecosystem-baseline.yml@49a06a7a54e5b4bfe607d3f32e242f72a7fc152b
     with:
       require-complete: true
       actions-security-blocking: false

examples/consumer-ecosystem-baseline.yml

@@ -23,7 +23,7 @@ jobs:
     permissions:
       actions: read
       contents: read
-    uses: filecoin-project/ff-sec-actions/.github/workflows/ecosystem-baseline.yml@24d5c70f87a771b3d3432efd12316f4e29251465
+    uses: filecoin-project/ff-sec-actions/.github/workflows/ecosystem-baseline.yml@49a06a7a54e5b4bfe607d3f32e242f72a7fc152b
     with:
       require-complete: true
       # Start finding gates advisory; enable after reviewing initial results.

examples/consumer-security-pipeline.yml

@@ -30,7 +30,7 @@ jobs:
       contents: read
       security-events: write
       pull-requests: write # dependency-review PR comments
-    uses: filecoin-project/ff-sec-actions/.github/workflows/security-pipeline.yml@24d5c70f87a771b3d3432efd12316f4e29251465
+    uses: filecoin-project/ff-sec-actions/.github/workflows/security-pipeline.yml@49a06a7a54e5b4bfe607d3f32e242f72a7fc152b
     with:
       # Safe baseline: inspect manifests and lockfiles without running package
       # installation hooks from repository content.

scripts/test-consumer-alpha.sh

@@ -31,6 +31,22 @@ canary_ref="$(release_ref "$canary")"
 git -C "$repo_root" cat-file -e "$example_ref:.github/workflows/ecosystem-baseline.yml" \
   || fail "consumer release commit is unavailable in repository history"
 
+# GitHub validates every nested workflow's complete permission envelope before
+# evaluating job conditions. Prove the immutable baseline graph never asks the
+# read-only caller to elevate authority, including in disabled jobs.
+baseline_content="$(git -C "$repo_root" show "$example_ref:.github/workflows/ecosystem-baseline.yml")"
+while IFS='|' read -r nested_path nested_ref; do
+  [ -n "$nested_path" ] || continue
+  nested_content="$(git -C "$repo_root" show "$nested_ref:$nested_path")" \
+    || fail "baseline nested workflow is unavailable: $nested_path@$nested_ref"
+  if grep -Eq '^[[:space:]]+[a-z-]+:[[:space:]]+write([[:space:]#]|$)' <<< "$nested_content"; then
+    fail "read-only baseline calls a workflow with write authority: $nested_path@$nested_ref"
+  fi
+done < <(
+  sed -nE "s#^[[:space:]]*uses:[[:space:]]+${repository}/(\.github/workflows/[^@]+)@([0-9a-f]{40}).*#\1|\2#p" \
+    <<< "$baseline_content"
+)
+
 for workflow in "$example" "$canary"; do
   grep -Fq 'require-complete: true' "$workflow" \
     || fail "$workflow does not require complete evaluation"