ci: harden

.github/workflows/build.yml

@@ -6,6 +6,9 @@ on:
     branches: [main]
     paths-ignore: ["docs/**"]
 
+permissions:
+  id-token: write
+
 jobs:
   build:
     if: github.repository == 'catppuccin/userstyles'
@@ -18,7 +21,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          token: ${{ secrets.USERSTYLES_TOKEN }}
+          persist-credentials: false
 
       - name: Setup Deno
         uses: nekowinston/setup-deno@main

.github/workflows/ci.yml

@@ -4,6 +4,10 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   ci:
     runs-on: ubuntu-latest
@@ -59,4 +63,6 @@ jobs:
           push: false
 
       - name: Push changes
-        run: git push origin "HEAD:${{ github.ref }}" --atomic
+        run: git push origin "HEAD:$REF" --atomic
+        env:
+          REF: ${{ github.ref }}

.github/workflows/deno-check.yml

@@ -8,13 +8,17 @@ on:
     branches: [main]
     paths: ["**/*.ts"]
 
+permissions: {}
+
 jobs:
   check:
     if: github.repository == 'catppuccin/userstyles'
     runs-on: ubuntu-latest
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Setup Deno
         uses: nekowinston/setup-deno@main

.github/workflows/deno-lock.yml

@@ -5,6 +5,9 @@ on:
     branches: [main]
     paths: ["deno.json"]
 
+permissions:
+  contents: write
+
 jobs:
   deno-lock:
     name: Update Deno lock

.github/workflows/issues.yml

@@ -5,6 +5,8 @@ on:
   issues:
     types: [opened, edited]
 
+permissions: {}
+
 jobs:
   triage:
     runs-on: ubuntu-latest

.github/workflows/lint.yml

@@ -8,13 +8,17 @@ on:
     branches: [main]
     paths-ignore: ["docs/**"]
 
+permissions: {}
+
 jobs:
   lint:
     if: github.repository == 'catppuccin/userstyles'
     runs-on: ubuntu-latest
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Setup Deno
         uses: nekowinston/setup-deno@main

.github/workflows/maintainers.yml

@@ -6,13 +6,17 @@ on:
     branches: [main]
     paths: ["scripts/userstyles.yml"]
 
+permissions: {}
+
 jobs:
   sync-maintainers:
     if: github.repository == 'catppuccin/userstyles'
     runs-on: ubuntu-latest
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Setup Deno
         uses: nekowinston/setup-deno@main

.github/workflows/pull-requests.yml

@@ -1,7 +1,11 @@
 name: Pull Request Labeler
 
 on:
-  pull_request_target:
+  pull_request:
+
+permissions:
+  pull-requests: write
+  contents: read
 
 jobs:
   triage:
@@ -10,6 +14,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Add pull request labels
         uses: actions/[email protected]

.github/workflows/sync-labels.yml

@@ -6,6 +6,8 @@ on:
     branches: [main]
     paths: [".github/labels.yml"]
 
+permissions: {}
+
 jobs:
   sync:
     if: github.repository == 'catppuccin/userstyles'

.github/workflows/website.yml

@@ -6,6 +6,8 @@ on:
     branches: [main]
     paths: ["scripts/userstyles.yml"]
 
+permissions: {}
+
 jobs:
   deploy:
     if: github.repository == 'catppuccin/userstyles'