Declare the token scopes, drop the stored checkout credentials, lock the actions and add the Plumber check

.github/workflows/actions.lock

@@ -0,0 +1,127 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/ci.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-go@v7.0.0'
+        - 'actions/setup-python@v7.1.0'
+        - 'amannn/action-semantic-pull-request@v6.1.1'
+        - 'golangci/golangci-lint-action@v9.3.0'
+        - 'slackapi/slack-github-action@v4.0.0'
+    '.github/workflows/clean-release-notes.yml':
+        - 'actions/github-script@v9.0.0'
+    '.github/workflows/codeql.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'github/codeql-action@v4.39.1'
+    '.github/workflows/integration_tests_pr.yml':
+        - 'actions-ecosystem/action-regex-match@v2.0.2'
+        - 'actions/checkout@v7.0.1'
+        - 'actions/github-script@v9.0.0'
+        - 'actions/setup-go@v7.0.0'
+        - 'actions/setup-python@v7.1.0'
+        - 'octokit/graphql-action@v2.x'
+    '.github/workflows/labeler.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'crazy-max/ghaction-github-labeler@v6.0.0'
+    '.github/workflows/nightly_smoke_tests.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-go@v7.0.0'
+        - 'slackapi/slack-github-action@v4.0.0'
+    '.github/workflows/plumber.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'getplumber/plumber@v0.7.16'
+    '.github/workflows/release-cross-repo-test.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-go@v7.0.0'
+    '.github/workflows/release-notify-slack.yml':
+        - 'slackapi/slack-github-action@v4.0.0'
+    '.github/workflows/security_pr.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/dependency-review-action@v5.0.0'
+        - 'securego/gosec@v2.30.0'
+dependencies:
+    'actions-ecosystem/action-regex-match@v2.0.2':
+        ref: 'v2.0.2'
+        commit: 'sha1-9e6c4fb3d5e898f505be7a1fb6e7b0a278f6665b'
+        owner_id: 56633079
+        repo_id: 261130368
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/dependency-review-action@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-a1d282b36b6f3519aa1f3fc636f609c47dddb294'
+        owner_id: 44036562
+        repo_id: 476372928
+    'actions/github-script@v9.0.0':
+        ref: 'v9.0.0'
+        commit: 'sha1-3a2844b7e9c422d3c10d287c895573f7108da1b3'
+        owner_id: 44036562
+        repo_id: 205262760
+    'actions/setup-go@v7.0.0':
+        ref: 'v7.0.0'
+        commit: 'sha1-b7ad1dad31e06c5925ef5d2fc7ad053ef454303e'
+        owner_id: 44036562
+        repo_id: 192624594
+    'actions/setup-python@v7.1.0':
+        ref: 'v7.1.0'
+        commit: 'sha1-6d4fd22b20465ccc0f7354476588e8df7c9ca0e0'
+        owner_id: 44036562
+        repo_id: 192625525
+    'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9':
+        ref: 'v7.0.2'
+        commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+        owner_id: 44036562
+        repo_id: 192625955
+    'amannn/action-semantic-pull-request@v6.1.1':
+        ref: 'v6.1.1'
+        commit: 'sha1-48f256284bd46cdaab1048c3721360e808335d50'
+        owner_id: 4038316
+        repo_id: 220418983
+    'crazy-max/ghaction-github-labeler@v6.0.0':
+        ref: 'v6.0.0'
+        commit: 'sha1-548a7c3603594ec17c819e1239f281a3b801ab4d'
+        owner_id: 1951866
+        repo_id: 216050313
+    'getplumber/plumber@v0.7.16':
+        ref: 'v0.7.16'
+        commit: 'sha1-e9ad2dc6d6faa2dfd84395aac18e461284062640'
+        owner_id: 255179076
+        repo_id: 1137327132
+        uses:
+            - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+            - 'github/codeql-action@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee'
+    'github/codeql-action@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee':
+        ref: 'v4.39.0'
+        commit: 'sha1-6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee'
+        owner_id: 9919
+        repo_id: 259445878
+    'github/codeql-action@v4.39.1':
+        ref: 'v4.39.1'
+        commit: 'sha1-9b3254085494b55a0f7c4c2b3d2d52cc712ce370'
+        owner_id: 9919
+        repo_id: 259445878
+    'golangci/golangci-lint-action@v9.3.0':
+        ref: 'v9.3.0'
+        commit: 'sha1-ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a'
+        owner_id: 35628013
+        repo_id: 232539879
+    'octokit/graphql-action@v2.x':
+        ref: 'v2.x'
+        commit: 'sha1-f7836e89a7e5bac63911bbe9653c21147b3d9bc3'
+        owner_id: 3430433
+        repo_id: 213717672
+    'securego/gosec@v2.30.0':
+        ref: 'v2.30.0'
+        commit: 'sha1-5eb1d104ef85ff2c905c877eb600e8c1dee33a22'
+        owner_id: 23195997
+        repo_id: 63625434
+    'slackapi/slack-github-action@v4.0.0':
+        ref: 'v4.0.0'
+        commit: 'sha1-dcb1066f776dd043e64d0e8ba94ca15cc7e1875d'
+        owner_id: 6962987
+        repo_id: 306439799

.github/workflows/ci.yml

@@ -24,6 +24,9 @@ on:
       - main
   pull_request: null
 
+permissions:
+  contents: read
+
 jobs:
   lint-tidy:
     runs-on: ubuntu-latest
@@ -38,7 +41,7 @@ jobs:
       # - PRs labeled 'ignore-for-release' (release PRs that don't need a ticket prefix)
       - name: Validate PR Title
         if: github.event_name == 'pull_request'
-        uses: amannn/action-semantic-pull-request@v6
+        uses: amannn/action-semantic-pull-request@v6.1.1
         with:
           types: |
             TPT-\d+
@@ -56,13 +59,15 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ github.token }}
 
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v7
+      - uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@v7.0.0
         with:
           go-version: stable
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v9
+        uses: golangci/golangci-lint-action@v9.3.0
         with:
           version: latest
 
@@ -83,19 +88,20 @@ jobs:
       EXIT_STATUS: 0
     steps:
       - name: Clone Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: 'recursive'
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v7.0.0
         with:
           go-version: 'stable'
       - run: go version
 
       - name: Setup Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@v7.1.0
         with:
           python-version: '3.x'
 
@@ -136,7 +142,7 @@ jobs:
 
     steps:
       - name: Notify Slack
-        uses: slackapi/slack-github-action@v4
+        uses: slackapi/slack-github-action@v4.0.0
         with:
           method: chat.postMessage
           token: ${{ secrets.SLACK_BOT_TOKEN }}

.github/workflows/clean-release-notes.yml

@@ -12,7 +12,7 @@ jobs:
 
     steps:
       - name: Remove ticket prefixes from release notes
-        uses: actions/github-script@v9
+        uses: actions/github-script@v9.0.0
         with:
           script: |
             const release = context.payload.release;

.github/workflows/codeql.yml

@@ -23,16 +23,18 @@ jobs:
           build-mode: autobuild
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@v7.0.1
+      with:
+        persist-credentials: false
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@v4.39.1
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
         queries: security-and-quality
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@v4.39.1
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/integration_tests_pr.yml

@@ -22,16 +22,24 @@ on:
 
 name: Integration tests on PR
 
+permissions:
+  contents: read
+
 jobs:
   integration-fork:
+    permissions:
+      contents: read
+      # Reads the pull request head and updates this job's check run.
+      pull-requests: read
+      checks: write
     runs-on: ubuntu-latest
     if: github.event_name == 'workflow_dispatch' && inputs.sha != ''
     steps:
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@v7.0.0
         with:
           go-version: 'stable'
       - run: go version
-      - uses: actions-ecosystem/action-regex-match@v2
+      - uses: actions-ecosystem/action-regex-match@v2.0.2
         id: disallowed-char-check
         with:
           text: ${{ inputs.module }}
@@ -40,8 +48,9 @@ jobs:
 
       # Check out merge commit
       - name: Checkout PR
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
+          persist-credentials: false
           ref: ${{ inputs.sha }}
 
       - run: make ARGS="-run $MODULE" fixtures
@@ -82,7 +91,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/github-script@v9
+      - uses: actions/github-script@v9.0.0
         id: update-check-run
         if: ${{ inputs.pull_request_number != '' && fromJson(steps.commit-hash.outputs.data).repository.pullRequest.headRef.target.oid == inputs.sha }}
         env:
@@ -117,8 +126,9 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: 'recursive'
 
@@ -143,7 +153,7 @@ jobs:
 
     steps:
       - name: Set up Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@v7.1.0
         with:
           python-version: '3.x'
 

.github/workflows/labeler.yml

@@ -12,16 +12,25 @@ on:
       - '.github/labels.yml'
       - '.github/workflows/labeler.yml'
 
+permissions:
+  contents: read
+
 jobs:
   labeler:
+    permissions:
+      contents: read
+      # Label sync creates and updates the repository labels.
+      issues: write
     runs-on: ubuntu-latest
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
       -
         name: Run Labeler
-        uses: crazy-max/ghaction-github-labeler@548a7c3603594ec17c819e1239f281a3b801ab4d
+        uses: crazy-max/ghaction-github-labeler@v6.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           yaml-file: .github/labels.yml

.github/workflows/nightly_smoke_tests.yml

@@ -11,21 +11,25 @@ on:
         default: ''
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   smoke_tests:
     if: github.repository == 'linode/linodego' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
+          persist-credentials: false
           fetch-depth: 0
           submodules: 'recursive'
           ref: ${{ github.event.inputs.sha || github.ref }}
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v7.0.0
         with:
           go-version: '1.x'
 
@@ -38,7 +42,7 @@ jobs:
 
       - name: Notify Slack
         if: (success() || failure()) && github.repository == 'linode/linodego'
-        uses: slackapi/slack-github-action@v4
+        uses: slackapi/slack-github-action@v4.0.0
         with:
           method: chat.postMessage
           token: ${{ secrets.SLACK_BOT_TOKEN }}