Harden gh actions

[datosh]

I had some fun comparing GHA security scanners and needed a victim / beneficiary 😉

I used zizmore, poutine, octoscan and github-actions-scanner.

In the end - all the changes I made were based on findings from zizmore. Here are the specific issues I fixed:

• https://docs.zizmor.sh/audits/#artipacked
• https://docs.zizmor.sh/audits/#cache-poisoning
• https://docs.zizmor.sh/audits/#excessive-permissions
• https://docs.zizmor.sh/audits/#unpinned-uses

They support running the checks in GHA, which might be a nice addition, if you end up agreeing with the changes.

Additionally, I would suggest that we add either dependabot or renovate to get version upgrade for GHA - as the versions are now pinned - might be nice for Go as well. Happy to create follow-up issues if you like the direction.

I did run each action in my fork using workflow_dispatch to verify they still work:

• https://github.com/datosh/opkssh/actions/runs/15084130230
• https://github.com/datosh/opkssh/actions/runs/15084086638
• https://github.com/datosh/opkssh/actions/runs/15084082929
• https://github.com/datosh/opkssh/actions/runs/15084076712
• https://github.com/datosh/opkssh/actions/runs/15084066794
• https://github.com/datosh/opkssh/actions/runs/15083917449

[EthanHeilman]

LGTM - This is really great

[EthanHeilman]

Additionally, I would suggest that we add either dependabot or renovate to get version upgrade for GHA - as the versions are now pinned - might be nice for Go as well. Happy to create follow-up issues if you like the direction. They support running the checks in GHA, which might be a nice addition, if you end up agreeing with the changes.

Please do

[EthanHeilman]

@datosh This appears to have broken something

https://github.com/openpubkey/opkssh/actions/runs/15089597609/job/42416411626

[datosh]

That's odd - I pulled the changes into my fork and it builds just fine on main: https://github.com/datosh/opkssh/actions/runs/15107805718

Also the test I did prior to sending the PR was green: https://github.com/datosh/opkssh/actions/runs/15084082929

Could you rerun the pipeline to see if the action itself might be flaky?

edit: This might be another instance of #184 - same exact error message!

[EthanHeilman]

@datosh You are right, it has nothing to do with your change. This error seems to occur whenever we make a change to GHA and then merge to main, rerunning makes it go away.