ci: audit the workflows every generated project runs

These five workflows execute in every project this account generates, with
contents: write, packages: write and the release app private key. Nothing
checked them: the scaffold toolbox asserts they are sha-pinned and disable
credential persistence, but skips both tests whenever a dot-github checkout is
not beside it — which is every CI run there.

The first run found one: the app token added yesterday inherited every
permission the app was installed with, in every repository it can reach.
Release Please needs contents: write and pull-requests: write, and now says so.

zizmor and actionlint, plus the three invariants a generated project depends
on, kept here rather than in a repository that may not be checked out.

Author: nghiatruongtps

.github/workflows/app-release.yml

@@ -45,6 +45,12 @@ jobs:
         with:
           app-id: ${{ secrets.RELEASE_APP_ID }}
           private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+          # Without these the token carries every permission the app was
+          # installed with, in every repository the app can reach. Release
+          # Please needs exactly two: the release commit and tag, and the
+          # pull request it opens.
+          permission-contents: write
+          permission-pull-requests: write
       - id: release
         uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         with:

.github/workflows/ci.yml

@@ -0,0 +1,27 @@
+name: CI
+on:
+  pull_request:
+  push:
+    branches: [main]
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+permissions: {}
+
+# The workflows in this repository run inside every project the scaffold
+# toolbox generates, with contents: write, packages: write and the release
+# app's private key. Until this file existed they were checked only from that
+# toolbox's own test suite, which skips those tests whenever a dot-github
+# checkout is not sitting beside it — so on its CI they never ran at all.
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      - run: mise run ci

mise.lock

@@ -0,0 +1,40 @@
+[tools]
+zizmor = "1.29.0"
+"aqua:rhysd/actionlint" = "1.7.12"
+
+[settings]
+pin = true
+lockfile = true
+
+[tasks.lint]
+description = "audit the reusable workflows every generated project runs"
+run = ["zizmor .github/workflows/", "actionlint"]
+
+# These run in every project this account generates, with contents: write,
+# packages: write and the release app's private key. Until this repository had
+# CI of its own they were only ever checked from the scaffold toolbox's test
+# suite, which skips them whenever a dot-github checkout is not beside it —
+# that is, on every CI run there.
+[tasks.check]
+description = "the invariants a generated project depends on"
+run = [
+  """
+  unpinned="$(grep -rhoE 'uses: [^ ]+@[^ ]+' .github/workflows/ | grep -vE '@[0-9a-f]{40}$' || true)"
+  [ -z "$unpinned" ] || { printf 'actions not pinned to a sha:\\n%s\\n' "$unpinned" >&2; exit 1; }
+  """,
+  """
+  checkouts="$(grep -c 'actions/checkout@' .github/workflows/*.yml | awk -F: '{s+=$2} END {print s}')"
+  persist="$(grep -c 'persist-credentials: false' .github/workflows/*.yml | awk -F: '{s+=$2} END {print s}')"
+  [ "$checkouts" = "$persist" ] || {
+    printf '%s checkouts but %s persist-credentials: false\\n' "$checkouts" "$persist" >&2; exit 1; }
+  """,
+  """
+  for wf in .github/workflows/*.yml; do
+    grep -q '^permissions: {}' "$wf" \\
+      || { printf '%s does not start from a closed permission set\\n' "$wf" >&2; exit 1; }
+  done
+  """,
+]
+
+[tasks.ci]
+run = [{ task = "lint" }, { task = "check" }]