ci: harden workflows and pin dependencies for OpenSSF Scorecard

- Declare a read-only top-level permissions block in every workflow and
  move the write scopes each job actually uses to the job level, including
  the caller jobs of the zxc-* reusable workflows (Token-Permissions)
- Pin the node:21 and node:21-slim base images by digest and switch the
  Dockerfile to npm ci so installs honour package-lock.json
  (Pinned-Dependencies)
- Add fast-check as a devDependency with a property-based test for
  normalizeBalance (Fuzzing)

No CodeQL workflow is added: the repository already runs CodeQL through
GitHub's default setup, which rejects analysis uploads from a
workflow-based configuration while it is enabled.

Signed-off-by: Michael Garber <michael.garber@hashgraph.com>

Author: mgarbs

.github/workflows/flow-build-application.yaml

@@ -43,21 +43,30 @@ defaults:
     shell: bash
 
 permissions:
-  id-token: write
   contents: read
-  actions: read
-  pull-requests: write
-  checks: write
-  statuses: write
 
 jobs:
   code:
     name: Code
     uses: ./.github/workflows/zxc-compile-code.yaml
+    permissions:
+      id-token: write
+      contents: read
+      actions: read
+      pull-requests: write
+      checks: write
+      statuses: write
 
   code-style:
     name: Code Style
     uses: ./.github/workflows/zxc-compile-code.yaml
+    permissions:
+      id-token: write
+      contents: read
+      actions: read
+      pull-requests: write
+      checks: write
+      statuses: write
     needs:
       - code
     with:
@@ -67,6 +76,13 @@ jobs:
   unit-tests:
     name: Unit Tests
     uses: ./.github/workflows/zxc-compile-code.yaml
+    permissions:
+      id-token: write
+      contents: read
+      actions: read
+      pull-requests: write
+      checks: write
+      statuses: write
     if: ${{ github.event_name == 'push' || github.event.inputs.enable-unit-tests == 'true' }}
     with:
       custom-job-label: Standard
@@ -75,6 +91,13 @@ jobs:
   integration-tests:
     name: Integration Tests
     uses: ./.github/workflows/zxc-compile-code.yaml
+    permissions:
+      id-token: write
+      contents: read
+      actions: read
+      pull-requests: write
+      checks: write
+      statuses: write
     if: ${{ github.event_name == 'push' || github.event.inputs.enable-integration-tests == 'true' }}
     with:
       custom-job-label: Standard
@@ -87,6 +110,12 @@ jobs:
   analyze:
     name: Analyze
     uses: ./.github/workflows/zxc-code-analysis.yaml
+    permissions:
+      contents: read
+      actions: read
+      pull-requests: write
+      checks: write
+      statuses: write
     needs:
       - unit-tests
       - integration-tests

.github/workflows/flow-deploy-release-artifact.yaml

@@ -29,18 +29,20 @@ defaults:
     shell: bash
 
 permissions:
-  id-token: write
-  checks: write
-  statuses: write
-  pull-requests: write
-  contents: write
-  issues: write
-  actions: read
+  contents: read
 
 jobs:
   prepare-release:
     name: Release / Prepare
     runs-on: hiero-cli-linux-medium
+    permissions:
+      id-token: write
+      checks: write
+      statuses: write
+      pull-requests: write
+      contents: write
+      issues: write
+      actions: read
     outputs:
       version: ${{ steps.set-outputs.outputs.version }}
       need-release: ${{ steps.set-outputs.outputs.need-release }}
@@ -133,6 +135,13 @@ jobs:
   safety-checks:
     name: Release
     uses: ./.github/workflows/zxc-compile-code.yaml
+    permissions:
+      id-token: write
+      contents: read
+      actions: read
+      pull-requests: write
+      checks: write
+      statuses: write
     with:
       custom-job-label: 'Safety Checks'
       enable-unit-tests: true
@@ -147,6 +156,14 @@ jobs:
     name: Github / Release
     if: ${{ needs.prepare-release.outputs.need-release == 'true' }}
     runs-on: hiero-cli-linux-medium
+    permissions:
+      id-token: write
+      checks: write
+      statuses: write
+      pull-requests: write
+      contents: write
+      issues: write
+      actions: read
     needs:
       - prepare-release
       - safety-checks
@@ -291,6 +308,14 @@ jobs:
     name: Publish Hiero CLI NPM Package
     if: ${{ needs.prepare-release.outputs.need-release == 'true' && inputs.dry-run-enabled != true }}
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      checks: write
+      statuses: write
+      pull-requests: write
+      contents: write
+      issues: write
+      actions: read
     needs:
       - create-github-release
       - prepare-release

.github/workflows/flow-pull-request-checks.yaml

@@ -27,6 +27,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 concurrency:
   group: pr-checks-${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
@@ -35,10 +38,24 @@ jobs:
   build:
     name: Code
     uses: ./.github/workflows/zxc-compile-code.yaml
+    permissions:
+      id-token: write
+      contents: read
+      actions: read
+      pull-requests: write
+      checks: write
+      statuses: write
 
   code-style:
     name: Code Style
     uses: ./.github/workflows/zxc-compile-code.yaml
+    permissions:
+      id-token: write
+      contents: read
+      actions: read
+      pull-requests: write
+      checks: write
+      statuses: write
     needs:
       - build
     with:
@@ -48,6 +65,13 @@ jobs:
   unit-tests:
     name: Unit Tests
     uses: ./.github/workflows/zxc-compile-code.yaml
+    permissions:
+      id-token: write
+      contents: read
+      actions: read
+      pull-requests: write
+      checks: write
+      statuses: write
     needs:
       - code-style
     with:
@@ -57,6 +81,13 @@ jobs:
   integration-tests:
     name: Integration Tests
     uses: ./.github/workflows/zxc-compile-code.yaml
+    permissions:
+      id-token: write
+      contents: read
+      actions: read
+      pull-requests: write
+      checks: write
+      statuses: write
     needs:
       - code-style
     with:
@@ -70,6 +101,12 @@ jobs:
   codecov:
     name: CodeCov
     uses: ./.github/workflows/zxc-code-analysis.yaml
+    permissions:
+      contents: read
+      actions: read
+      pull-requests: write
+      checks: write
+      statuses: write
     needs:
       - unit-tests
       - integration-tests
@@ -84,6 +121,12 @@ jobs:
   codacy-coverage:
     name: Codacy
     uses: ./.github/workflows/zxc-code-analysis.yaml
+    permissions:
+      contents: read
+      actions: read
+      pull-requests: write
+      checks: write
+      statuses: write
     needs:
       - unit-tests
       - integration-tests

.github/workflows/flow-pull-request-formatting.yaml

@@ -29,7 +29,7 @@ defaults:
     shell: bash
 
 permissions:
-  statuses: write
+  contents: read
 
 concurrency:
   group: pr-formatting-${{ github.workflow }}-${{ github.head_ref || github.run_id }}
@@ -39,6 +39,8 @@ jobs:
   title-check:
     name: Title Check
     runs-on: hiero-cli-linux-medium
+    permissions:
+      statuses: write
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0

.github/workflows/zxc-code-analysis.yaml

@@ -72,15 +72,17 @@ defaults:
 
 permissions:
   contents: read
-  actions: read
-  pull-requests: write
-  checks: write
-  statuses: write
 
 jobs:
   analyze:
     name: ${{ inputs.custom-job-label || 'Analyze' }}
     runs-on: hiero-cli-linux-medium
+    permissions:
+      contents: read
+      actions: read
+      pull-requests: write
+      checks: write
+      statuses: write
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0

.github/workflows/zxc-compile-code.yaml

@@ -64,17 +64,19 @@ defaults:
     shell: bash
 
 permissions:
-  id-token: write
   contents: read
-  actions: read
-  pull-requests: write
-  checks: write
-  statuses: write
 
 jobs:
   compile:
     name: ${{ inputs.custom-job-label || 'Compiles' }}
     runs-on: hiero-cli-linux-medium
+    permissions:
+      id-token: write
+      contents: read
+      actions: read
+      pull-requests: write
+      checks: write
+      statuses: write
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0

Dockerfile

@@ -1,12 +1,12 @@
 # Build stage
-FROM node:21 AS build-stage
+FROM node:21@sha256:4b232062fa976e3a966c49e9b6279efa56c8d207a67270868f51b3d155c4e33d AS build-stage
 WORKDIR /app
 
 # Copy package.json and package-lock.json
 COPY package*.json ./
 
 # Install dependencies
-RUN npm install
+RUN npm ci
 
 # Copy the rest of the application code
 COPY . .
@@ -15,7 +15,7 @@ COPY . .
 RUN npm run build
 
 # Production stage
-FROM node:21-slim AS production-stage
+FROM node:21-slim@sha256:dfc05dee209a1d7adf2ef189bd97396daad4e97c6eaa85778d6f75205ba1b0fb AS production-stage
 WORKDIR /app
 
 # Set CI environment variable to skip Husky setup
@@ -25,7 +25,7 @@ ENV CI=true
 COPY package*.json ./
 
 # Install only production dependencies
-RUN npm install --omit=dev
+RUN npm ci --omit=dev
 
 # Copy the built code from the build stage
 COPY --from=build-stage /app/dist ./dist

package-lock.json

@@ -105,6 +105,7 @@
     "eslint-plugin-no-relative-import-paths": "1.6.1",
     "eslint-plugin-prettier": "5.5.6",
     "eslint-plugin-simple-import-sort": "13.0.0",
+    "fast-check": "4.9.0",
     "husky": "9.1.7",
     "jest": "30.4.2",
     "jest-junit": "17.0.0",