Apply some security hardening, as recommended by OSSF scorecard

[NWilson]

• Use hashes to pin versions of third-party Actions used in CI
• Use GitHub's dependabot to do a monthly update of the Actions
• Restrict all Workflows to use a read-only token (except for the steps which need to upload a SARIF file)

[zherczeg]

Will this make our life easier or more difficult? Is this needed for CI security, or what is the actual gain here?

[NWilson]

It's needed for CI security. As it stands, we depend on some third party github actions, and if someone pushed malicious code to those repos, they would be able to perform pretty much arbitrary actions on our PCRE2 repo, the next time CI runs.

It should be much more locked down.

[NWilson]

These changes won't make our life more difficult (nor any easier).

[zherczeg]

This is disturbing. Can a CI write the repository in any way? Where can I disable that?

[NWilson]

Yes, sadly. The GitHub Actions have a very permissive token by default - a CI job can happily check out the code, make some changes, and push them to the master branch (and even rewrite history on master). The token that's used by the git checkout job can happily push code too.

And worse, it can even perform other actions on the GitHub organisation using the HTTP API (or GitHub CLI).

Adding permissions: contents: read locks down the runner to only have read access to the "contents" (code and issues) of the repo.

[zherczeg]

Thank you for the explanation.

I found this in Settings/Actions/General

Workflow permissions

Choose the default permissions granted to the GITHUB_TOKEN when running workflows in this repository. You can specify more granular permissions in the workflow using YAML. Learn more about managing permissions.

Read and write permissions
Workflows have read and write permissions in the repository for all scopes.

Read repository contents and packages permissions
Workflows have read permissions in the repository for the contents and packages scopes only.

@PhilipHazel may I change this to read-only? Honestly, I am shocked that writing is the default.

[PhilipHazel]

Yes, yes, do go ahead. I too am a bit shocked.

[zherczeg]

Config updated. Back to the patch, I am neutral, we can land it. Security is not my strength.

[NWilson]

I've broken the Scorecard scanning - because it's designed to run on master but not on PRs! So it wasn't really possible to discover problems before merging. Hmm.

I'll sort it out, don't worry.