ci: address supply-chain review feedback

Author: julienld

.github/workflows/_update-addon-config.yml

@@ -62,6 +62,7 @@ jobs:
         with:
           app-id: ${{ secrets.RELEASE_APP_ID }}
           private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+          permission-contents: write
         continue-on-error: true
 
       - name: Determine push token

.github/workflows/deploy.yml

@@ -46,9 +46,7 @@ jobs:
           cache-dependency-path: site/package-lock.json
 
       - name: Install dependencies
-        run: |
-          npm install --global npm@12.0.2
-          npm ci
+        run: corepack npm ci
 
       - name: Build with Astro
         run: npm run build

.github/workflows/locale-sync.yml

@@ -312,6 +312,7 @@ jobs:
       with:
         app-id: ${{ secrets.RELEASE_APP_ID }}
         private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+        permission-contents: write
       continue-on-error: true
 
     - name: Ensure push credential

.github/workflows/pr.yml

@@ -45,6 +45,8 @@ jobs:
     if: github.event_name == 'pull_request'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - name: Fail component changes riding an already-released version
         env:
           BASE_REF: ${{ github.base_ref }}
@@ -97,6 +99,8 @@ jobs:
       run: ${{ steps.filter.outputs.run }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - name: Classify changed files
         id: filter
         env:
@@ -200,6 +204,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      with:
+        persist-credentials: false
 
     - name: Verify uv.lock is in sync with pyproject.toml
       run: uv lock --check
@@ -243,6 +249,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      with:
+        persist-credentials: false
 
     - name: Check AGENTS.md size
       run: |
@@ -264,6 +272,8 @@ jobs:
         working-directory: site
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      with:
+        persist-credentials: false
 
     - name: Setup Node
       uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
@@ -273,9 +283,7 @@ jobs:
         cache-dependency-path: site/package-lock.json
 
     - name: Install dependencies
-      run: |
-        npm install --global npm@12.0.2
-        npm ci
+      run: corepack npm ci
 
     - name: Astro type & diagnostics check
       run: npm run check
@@ -304,6 +312,8 @@ jobs:
       run: apt-get update -qq && apt-get install -y -qq git >/dev/null 2>&1
 
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      with:
+        persist-credentials: false
 
     - name: Install dependencies
       run: uv sync --dev
@@ -348,6 +358,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      with:
+        persist-credentials: false
 
     - name: Install dependencies
       run: uv sync --dev
@@ -365,6 +377,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      with:
+        persist-credentials: false
 
     - name: Install dependencies
       run: uv sync --dev
@@ -407,6 +421,7 @@ jobs:
 
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       with:
+        persist-credentials: false
         submodules: true
 
     - name: Set up Node.js
@@ -432,9 +447,7 @@ jobs:
       # `npm ci` enforces package-lock.json — same reproducibility
       # discipline as uv.lock on the Python side. No-op on cache hit
       # if node_modules matches the lockfile.
-      run: |
-        npm install --global npm@12.0.2
-        npm ci --prefix tests/js
+      run: cd tests/js && corepack npm ci
 
     - name: Run unit tests
       run: uv run pytest tests/src/unit/ -n auto --tb=short -v
@@ -480,6 +493,7 @@ jobs:
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       with:
+        persist-credentials: false
         submodules: true
 
     - name: Set up Docker Buildx
@@ -581,6 +595,7 @@ jobs:
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       with:
+        persist-credentials: false
         submodules: true
 
     - name: Set up Docker Buildx
@@ -678,6 +693,7 @@ jobs:
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       with:
+        persist-credentials: false
         submodules: true
         # fetch-depth 0: the update-path scenario checks the custom component
         # out at the released ``stable`` git tag, which the default shallow
@@ -766,6 +782,7 @@ jobs:
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       with:
+        persist-credentials: false
         submodules: true
 
     - name: Set up Docker Buildx

.github/workflows/publish-dev.yml

@@ -46,6 +46,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           # Full history: the dev version number is the commit count.
           fetch-depth: 0
 
@@ -84,6 +85,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           submodules: true
 
       - name: Install uv
@@ -122,6 +124,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           submodules: true
 
       - name: Set up Docker Buildx
@@ -162,6 +165,8 @@ jobs:
       contents: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Create pre-release
         env:

.github/workflows/release-publish.yml

@@ -26,6 +26,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           ref: master
           fetch-depth: 0
 
@@ -129,6 +130,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           ref: ${{ needs.prepare.outputs.release_tag }}
           fetch-depth: 0
           # Required for the bundled skills (resources/skills-vendor is a
@@ -164,6 +166,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           ref: ${{ needs.prepare.outputs.release_tag }}
           fetch-depth: 0
           # Required for the bundled skills (resources/skills-vendor is a
@@ -228,6 +231,8 @@ jobs:
           echo "Docker publish conclusion: ${{ needs.publish_docker.result }}"
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
         if: ${{ needs.publish_pypi.result == 'success' && needs.publish_docker.result == 'success' }}
         with:
           ref: ${{ needs.prepare.outputs.release_tag }}
@@ -266,6 +271,10 @@ jobs:
             --oci-image "$IMAGE"
           cat server.json
 
+      - name: Install uv
+        if: ${{ needs.publish_pypi.result == 'success' && needs.publish_docker.result == 'success' }}
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+
       - name: Validate server manifest
         if: ${{ needs.publish_pypi.result == 'success' && needs.publish_docker.result == 'success' }}
         run: |

.github/workflows/renovate.yml

@@ -41,6 +41,10 @@ jobs:
         with:
           app-id: ${{ secrets.RENOVATE_APP_ID }}
           private-key: ${{ secrets.RENOVATE_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-issues: write
+          permission-pull-requests: write
+          permission-workflows: write
 
       - name: Self-hosted Renovate
         uses: renovatebot/github-action@316d7cd859606d6039a2182b7d69199e9b036835 # v46.2.1

.github/workflows/semver-release.yml

@@ -70,6 +70,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       - name: Check for releasable commits since last tag
@@ -115,6 +116,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           submodules: true
 
       - name: Set up Docker Buildx
@@ -154,11 +156,13 @@ jobs:
       with:
         app-id: ${{ secrets.RELEASE_APP_ID }}
         private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+        permission-contents: write
       # Fallback to RELEASE_TOKEN (PAT) or GITHUB_TOKEN if app credentials not configured
       continue-on-error: true
 
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       with:
+        persist-credentials: false
         fetch-depth: 0
         # Priority: GitHub App token > RELEASE_TOKEN (PAT) > GITHUB_TOKEN
         token: ${{ steps.app-token.outputs.token || secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}

.github/workflows/sync-integration-mirror.yml

@@ -141,6 +141,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           # The release-notes step needs the full stable-tag history
           # (git tag -l 'v*') to find the previous and current server
           # release, not just the default single-commit shallow checkout.

.github/workflows/sync-tool-docs.yml

@@ -44,6 +44,7 @@ jobs:
       with:
         app-id: ${{ secrets.RELEASE_APP_ID }}
         private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+        permission-contents: write
       continue-on-error: true
 
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7