[SECURITY] Harden GitHub Workflows Pt. 2

[John McCall (lowlydba)]

Major change release plan

Non-Major change

B. Related MINOR change steps

Non-minor change

C. Public documentation and messaging plan

N/A

Description

The original PR (#493) was accidentally targeting fixes only for a subset of the desired risk level. This closes the gap, and we can confirm it now by the temporary, secondary OMF Security Checks workflow that is using the desired pedantic level.

Prior, due to repo settings it wasn't easily testable until after the workflow had been set as Required.

Reference

N/A

Testing

Proof of pedantic passing (logs):

[github-actions]

🗺️ Schema reference docs preview is live!

🌍 Preview	https://staging.overturemaps.org/schema/pr/496/schema/index.html
🕐 Updated	Apr 09, 2026 18:14 UTC
📝 Commit	fd71bb7
🔧 env SCHEMA_PREVIEW	true

Note

♻️ This preview updates automatically with each push to this PR.

[Alex Iannicelli (atiannicelli)]

fine by me

[Copilot]

Pull request overview

Hardens GitHub Actions workflows to satisfy the intended higher (“pedantic”) security posture (zizmor), primarily by tightening default token permissions, adding concurrency controls, and reducing direct template expansions in shell contexts.

Changes:

• Add workflow-level permissions: contents: read defaults and more explicit job permissions where needed.
• Add concurrency groups to reduce duplicate/colliding runs.
• Refactor some shell steps to use environment variables instead of direct ${{ ... }} expansions (and add zizmor ignore annotations).

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/test-schema.yaml	Adds workflow permissions defaults, concurrency, and job naming.
.github/workflows/schema-pr-preview.yml	Adds explanatory permission comments and uses env vars for PR number in deployment commands; adds a suppression for template-injection.
.github/workflows/schema-pr-preview-cleanup.yml	Adds concurrency and uses env vars for PR number in cleanup commands; adds suppression annotations.
.github/workflows/reusable-check-python-package-versions.yaml	Adds workflow permissions defaults and job naming; adds a zizmor ignore annotation near an env expression.
.github/workflows/publish-python-packages.yaml	Adds concurrency and job naming; refactors publish step to use env vars for matrix fields with zizmor suppressions.
.github/workflows/enforce-change-type-label.yaml	Adds workflow permissions defaults, concurrency, and job naming.
.github/workflows/check-python-package-versions.yaml	Moves id-token: write from workflow to job-level and adds concurrency.
.github/workflows/check-python-code.yaml	Adds workflow permissions defaults, concurrency, and job naming.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.