fix(ci): harden GitHub Actions workflows against supply chain attacks

.github/workflows/catalog-previews.yml

@@ -1,5 +1,8 @@
 name: Catalog Previews
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     branches: [main]
@@ -39,9 +42,10 @@ jobs:
           chrome-version: stable
 
       - name: Render changed block/component previews
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
         run: |
           # Find which blocks/components changed in this PR
-          BASE_SHA=${{ github.event.pull_request.base.sha }}
           CHANGED_ITEMS=$(git diff --name-only --diff-filter=ACMR "$BASE_SHA"...HEAD -- registry/blocks/ registry/components/ \
             | grep -E '^registry/(blocks|components)/' \
             | sed 's|^registry/[^/]*/\([^/]*\)/.*|\1|' \

.github/workflows/ci.yml

@@ -1,5 +1,9 @@
 name: CI
 
+permissions:
+  contents: read
+  pull-requests: read
+
 on:
   pull_request:
     # `edited` is required so the workflow re-fires when a PR's base ref is
@@ -224,11 +228,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 25
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           lfs: true
-      - uses: oven-sh/setup-bun@v2
-      - uses: actions/setup-node@v4
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 22
       - name: Install FFmpeg

.github/workflows/docs.yml

@@ -1,5 +1,8 @@
 name: Docs
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     branches: [main]

.github/workflows/player-perf.yml

@@ -1,5 +1,8 @@
 name: Player perf
 
+permissions:
+  contents: read
+
 on:
   pull_request:
   push:

.github/workflows/preview-regression.yml

@@ -1,5 +1,8 @@
 name: preview-regression
 
+permissions:
+  contents: read
+
 on:
   pull_request:
   push:

.github/workflows/publish.yml

@@ -1,5 +1,7 @@
 name: Publish to npm
 
+permissions: {}
+
 on:
   push:
     tags:
@@ -42,14 +44,18 @@ jobs:
 
       - name: Resolve version
         id: version
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          INPUT_VERSION: ${{ inputs.version }}
+          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
         run: |
-          if [ "${{ github.event_name }}" = "push" ]; then
+          if [ "$EVENT_NAME" = "push" ]; then
             VERSION="${GITHUB_REF_NAME#v}"
-          elif [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            VERSION="${{ inputs.version }}"
+          elif [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+            VERSION="${INPUT_VERSION}"
             VERSION="${VERSION#v}"
           else
-            BRANCH="${{ github.event.pull_request.head.ref }}"
+            BRANCH="${PR_HEAD_REF}"
             VERSION="${BRANCH#release/v}"
           fi
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
@@ -75,9 +81,11 @@ jobs:
 
       - name: Create release tag
         if: github.event_name == 'pull_request'
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
         run: |
-          git tag "v${{ steps.version.outputs.version }}"
-          git push origin "v${{ steps.version.outputs.version }}"
+          git tag "v$VERSION"
+          git push origin "v$VERSION"
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
@@ -92,9 +100,9 @@ jobs:
       - name: Publish packages
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          VERSION: ${{ steps.version.outputs.version }}
+          DIST_TAG: ${{ steps.version.outputs.dist_tag }}
         run: |
-          VERSION="${{ steps.version.outputs.version }}"
-          DIST_TAG="${{ steps.version.outputs.dist_tag }}"
           FAILED=0
 
           publish_pkg() {
@@ -153,14 +161,15 @@ jobs:
       - name: Create GitHub Release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ steps.version.outputs.version }}
+          PRERELEASE: ${{ steps.version.outputs.prerelease }}
+          REPO: ${{ github.repository }}
         run: |
-          VERSION="${{ steps.version.outputs.version }}"
-          PRERELEASE="${{ steps.version.outputs.prerelease }}"
           # Skip if release already exists (idempotent re-runs)
-          if gh release view "v${VERSION}" --repo "${{ github.repository }}" >/dev/null 2>&1; then
+          if gh release view "v${VERSION}" --repo "$REPO" >/dev/null 2>&1; then
             echo "Release v${VERSION} already exists — skipping"
           else
-            FLAGS=(--repo "${{ github.repository }}" --title "v${VERSION}" --generate-notes)
+            FLAGS=(--repo "$REPO" --title "v${VERSION}" --generate-notes)
             if [ "$PRERELEASE" = "true" ]; then
               FLAGS+=(--prerelease)
             fi

.github/workflows/regression.yml

@@ -1,5 +1,8 @@
 name: regression
 
+permissions:
+  contents: read
+
 on:
   pull_request:
   push:

.github/workflows/windows-render.yml

@@ -1,5 +1,8 @@
 name: Windows render verification
 
+permissions:
+  contents: read
+
 # Manually triggered smoke test that renders a HyperFrames composition on a
 # real Windows runner. Proves the PR #336 `where ffmpeg` fix actually works
 # end-to-end: FFmpeg is discovered natively on Windows, Chrome is installed