Tech Debt: Security hardening for `ui-plugin-examples` repo

[aalves08]

Is your feature request related to a problem? Please describe.

Tackle Tech debt around Security hardening for ui-plugin-examples repo:

• pin workflow actions to SHA
• docs with yarn install --frozen-lockfile
• reduce workflow permissions to minimum needed
• pin node dependencies

Describe the solution you'd like

Describe alternatives you've considered

Additional context

[github-actions]

🎯 Agentic Issue Triage

This is a tech debt tracking issue for security hardening improvements in the ui-plugin-examples repository. All four checklist items appear to be already completed (all boxes are checked ✅), suggesting this issue may be ready to close or is just being formally tracked in the milestone.

📋 Issue Summary

Field	Value
Type	Tech Debt / Enhancement
Area	Extensions (ui-plugin-examples repo)
Priority	priority/1 (High)
Milestone	v2.15.0
Assignee	@aalves08

Security hardening tasks tracked:

• Pin workflow actions to SHA (prevents supply-chain attacks via action tag mutation)
• Docs updated to use yarn install --frozen-lockfile
• Reduce workflow permissions to minimum needed (principle of least privilege)
• Pin node dependencies (ensures reproducible, tamper-resistant builds)

🔗 Related Issues

• #17507 — Tech debt: minimise permissions on ui-plugin-examples github workflows — a closely related issue covering the workflow permissions specifically (also open, priority/1)

These two issues appear to overlap in scope; #17509 is a rollup of multiple hardening tasks, one of which is the subject of #17507.

🛡️ Context & Background

These hardening tasks align with GitHub's security hardening for GitHub Actions guidelines:

• Pinning actions to SHA: Prevents tag-based hijacking (e.g., a compromised actions/checkout@v3 tag could be pointed to malicious code). Reference: GitHub docs on pinning.
• yarn install --frozen-lockfile: Ensures CI builds use exactly the versions in yarn.lock, preventing unexpected dependency resolution.
• Minimum workflow permissions: Scoped permissions: blocks in workflow YAML reduce blast radius if a workflow is compromised.
• Pinned node dependencies: Locks direct and transitive dependencies against unexpected mutation.

✅ Suggested Sub-tasks / Checklist

Since all items are already checked, the team should verify closure:

• Confirm all four changes have been merged to the ui-plugin-examples repo
• Verify Tech debt: minimise permissions on ui-plugin-examples github workflows #17507 (workflow permissions) is resolved or can be closed as covered by this issue
• Close this issue once the above is confirmed

💡 Nudges & Recommendations

• Consider using a tool like step-security/harden-runner or zizmor for automated GitHub Actions security auditing in the future.
• For ongoing dependency security, consider adding Dependabot or Renovate configuration to ui-plugin-examples to keep pinned versions up to date automatically.
• The ossf/scorecard action can provide an ongoing security posture score for the repo.

Generated by Agentic Triage for issue #17509 · ● 149.9K · ◷