ci: harden CI/release workflows (least-privilege token, SHA-pin third-party actions)

Public repo about to publish to PyPI, so the supply-chain threat model applies
most here. Borrowed from the same hardening applied to a downstream consumer
(itself borrowed from a public awesome-list repo's CI posture):

- ci.yml: add `permissions: contents: read` (it only checks out + tests/lints;
  specifying permissions also drops every unlisted scope to `none`, so a
  compromised action on an untrusted fork PR can't push/tag/open issues) and
  `concurrency` cancel-in-progress.
- ci.yml + release.yml: SHA-pin the third-party actions — `astral-sh/setup-uv`
  (v5.4.2) and, highest blast radius since it uploads to PyPI,
  `pypa/gh-action-pypi-publish` (v1.14.0). GitHub-owned checkout/*-artifact
  stay on major tags. release.yml's OIDC Trusted Publishing is untouched.

Also correct CLAUDE.md: both consumers now pin the kit as a git dep (not an
editable path dep). Test/lint commands are unchanged — pure config hardening.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: qazbnm456

.github/workflows/ci.yml

@@ -5,9 +5,18 @@ on:
     branches: [main]
   pull_request:
 
-# Action versions (checkout@v4, setup-uv@v5) are current majors; bump if a newer
-# major ships. CI needs no live model, no vLLM, no network, no Deno: the
-# dspy-bearing tests use a DummyLM or skip when dspy is absent.
+# Least privilege: this workflow only checks out code and runs tests/lint — it never writes. Specifying
+# `permissions:` also drops every unlisted scope to `none`, so a compromised dep/action on an untrusted
+# fork PR can't use the token to push, tag, or open issues. The third-party setup-uv action is SHA-pinned
+# (a repointed tag could inject code that runs with the token); GitHub-owned checkout stays on a major tag.
+# CI needs no live model, no vLLM, no network, no Deno: the dspy-bearing tests use a DummyLM or skip when
+# dspy is absent.
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   test:
@@ -20,7 +29,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           python-version: ${{ matrix.python-version }}
           enable-cache: true
@@ -34,7 +43,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           enable-cache: true
       - name: Lint

.github/workflows/release.yml

@@ -6,8 +6,9 @@ name: Release
 #        owner = qazbnm456, repo = rlm-kit, workflow = release.yml, environment = pypi
 #   2. In this repo's settings, create an environment named `pypi`.
 # Then publishing a GitHub Release (from a `vX.Y.Z` tag) builds + uploads automatically.
-# Action majors (checkout@v4, setup-uv@v5, *-artifact@v4, pypi-publish@release/v1) are
-# current; bump if a newer major ships.
+# Supply-chain: the two third-party actions are SHA-pinned — setup-uv, and (highest blast radius, it
+# uploads to PyPI) pypi-publish. Bump a SHA and its trailing version comment together. GitHub-owned
+# checkout/*-artifact stay on major tags.
 
 on:
   release:
@@ -22,7 +23,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
       - name: Build sdist + wheel
         run: uv build
       - uses: actions/upload-artifact@v4
@@ -42,4 +43,4 @@ jobs:
           name: dist
           path: dist/
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0

CHANGELOG.md

@@ -284,6 +284,15 @@ surfaced by dogfooding a real downstream consumer.
   (or `RLMConfig(max_tokens=None)`) to defer to the server. *(diagnosed by capturing per-call
   `finish_reason`/`reasoning_len`/`completion_tokens` on a telnet run; verified: 16 calls, 0 empty
   / 0 length-truncations at 16384 vs an empty at the 1000 cap.)*
+- **CI/release workflows hardened for the public-repo + PyPI-publish threat model** (`.github/workflows/`).
+  `ci.yml` now runs least-privilege (`permissions: contents: read` — it only checks out and tests/lints;
+  specifying `permissions:` drops every unlisted scope to `none`, so a compromised action on an untrusted
+  fork PR can't push, tag, or open issues) with `concurrency` cancel-in-progress. Both workflows now
+  SHA-pin their third-party actions — `astral-sh/setup-uv`, and (highest blast radius, it uploads to PyPI)
+  `pypa/gh-action-pypi-publish` — so a repointed tag can't inject code that runs with the token; GitHub-owned
+  `checkout`/`*-artifact` stay on major tags. `release.yml`'s OIDC Trusted Publishing (no API token,
+  `id-token: write` scoped to just the publish job) is untouched. *(Ported from the same hardening applied to
+  a downstream consumer, itself borrowed from a public awesome-list repo's CI posture.)*
 - **New `RLMConfig.adapter` (`RLM_ADAPTER`) selects the structured-output adapter; default
   `"json"` (schema-guided)** (`config.py`, `runtime.py`). Modes: `"json"` (default), `"chat"`,
   `"default"`.

CLAUDE.md

@@ -125,7 +125,7 @@ One companion rule ships under `.claude/rules/`:
 ## Consumer-driven hardening
 
 - This kit is driven by a real downstream consumer (a task that builds on the
-  scaffold via an editable path dep). That dogfooding is the design loop: when the consumer
+  scaffold, pinning the kit as a git dep — overlaid editable for local co-dev). That dogfooding is the design loop: when the consumer
   forces a workaround, log the **reusable** gap and fix it in the kit — do not special-case
   the consumer. Generic mechanics get promoted here via the base/wrap split (a generic base +
   syntactic guard + factory in the kit; the provider + tracing in the consumer); consumer-specific