🛡️ Security | Upgrade to latest dependencies in GHA & tweak installs/build

[Fdawgs]

Description

This PR:

• Bumps GitHub Actions to their latest major versions, which now use Node 16 internally instead of Node 12 (EOL as of end of April 2022, no longer receives security updates):
  • Changelog for actions/checkout can be found here
  • Releases for actions/setup-node can be found here

References

N/A

Testing

• This change adds test coverage for new/changed/fixed functionality

Checklist

• I have added documentation for new/changed functionality in this PR or in Slab
• I have updated or added public documentation
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not main

[Fdawgs]

There's probably a few more things that could be done to beef up CI security:

• Declares the minimum permissions for CI workflows to run at the workflow level, following principle of least privilege; see related GitHub security post
• Removes Git credentials/SSH keys after checkout as a security precaution by setting persist-credentials to false for actions/checkout action (obviously only when not using them)

[zrosenbauer]

@Fdawgs good looking on the updating the actions, bad C+P on our end 😄

I'll take a look at the permissions.

On the npm install vs ci I think thats the issue I hit... with the peerDep

[Fdawgs]

On the npm install vs ci I think thats the issue I hit... with the peerDep

Gotcha, I can see that now in the CI test failure, will revert.

[zrosenbauer]

@Fdawgs looks like its still failing (no idea why tbh) also made changes to deploy process so might conflict

I'm happy to merge just the updates to the GHA actions and do the npm changes in diff PR?

[zrosenbauer]

Until we can figure out the npm i I don't want to merge, we can merge in the GHA upgrades though

[Fdawgs]

@Fdawgs looks like its still failing (no idea why tbh) also made changes to deploy process so might conflict

I'm happy to merge just the updates to the GHA actions and do the npm changes in diff PR?

sounds good, will update PR.