chore: harden Github Actions workflows

.github/actions/verifyTSCMember/action.yml

@@ -13,15 +13,15 @@ runs:
   using: "composite"
   steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Install the dependencies
       run: npm install js-yaml@4.1.0
       shell: bash
 
     - name: Verify TSC Member
       id: verify_member
-      uses: actions/github-script@v6
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       env:
         COMMENTER_NAME: ${{ inputs.authorName }}
       with:

.github/workflows/add-good-first-issue-labels.yml

@@ -20,7 +20,7 @@ jobs:
       issues: write    # This is needed to add labels to issues.
     steps:
       - name: Add label
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ github.token }}
           script: |

.github/workflows/ambassador_management.yml

@@ -1,36 +1,42 @@
 name: Ambassador Management Workflow
 
-on:
-  pull_request_target:
+on: # zizmor: ignore[dangerous-triggers]
+  pull_request_target: # Using pull_request_target since this workflow needs to run with write permissions to the repository to manage organization membership and teams
     types: [closed]
     paths:
       - 'AMBASSADORS_MEMBERS.yaml'
 
+permissions: {}  # at workflow level to deny all permissions by default
+
 jobs:
   detect_ambassador_changes:
     if: github.event.pull_request.merged
     name: Update Ambassadors Members
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # only needs to read permissions to compare the files
 
     steps:
       - name: Checkout base commit
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ github.event.pull_request.base.sha }}
           path: community-main
+          persist-credentials: false
 
       - name: Checkout head commit
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           path: community
+          persist-credentials: false
 
       - name: Install js-yaml
         run: npm install js-yaml@4.1.0
 
       - name: Compare files
         id: compare-files
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fs = require('fs');
@@ -67,12 +73,16 @@
             core.info(fs.realpathSync('./community/AMBASSADORS_MEMBERS.yaml'));
 
       - name: Debug newAmbassadors output
+        env:
+          NEW_AMBASSADORS: ${{ steps.compare-files.outputs.newAmbassadors }}
         run: |
-          echo "newAmbassadors = ${{ steps.compare-files.outputs.newAmbassadors }}"
+          echo "newAmbassadors = $NEW_AMBASSADORS"
 
       - name: Debug removedAmbassadors output
+        env:
+          REMOVED_AMBASSADORS: ${{ steps.compare-files.outputs.removedAmbassadors }}
         run: |
-          echo "removedAmbassadors = ${{ steps.compare-files.outputs.removedAmbassadors }}"
+          echo "removedAmbassadors = $REMOVED_AMBASSADORS"
 
     outputs:
       newAmbassadors: ${{ steps.compare-files.outputs.newAmbassadors }}
@@ -84,11 +94,13 @@
     runs-on: ubuntu-latest
     steps:
       - name: Invite new ambassadors to the organization
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          NEW_AMBASSADORS: ${{ needs.detect_ambassador_changes.outputs.newAmbassadors }}
         with:
           github-token: ${{ secrets.GH_TOKEN_ORG_ADMIN }}
           script: |
-            const newAmbassadors = '${{ needs.detect_ambassador_changes.outputs.newAmbassadors }}'.split(',');
+            const newAmbassadors = process.env.NEW_AMBASSADORS.split(',');
             for (const ambassador of newAmbassadors) {
               try {
                 await github.request('PUT /orgs/{org}/memberships/{username}', {
@@ -101,11 +113,13 @@
             }
 
       - name: Add new ambassadors to the team
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          NEW_AMBASSADORS: ${{ needs.detect_ambassador_changes.outputs.newAmbassadors }}
         with:
           github-token: ${{ secrets.GH_TOKEN_ORG_ADMIN }}
           script: |
-            const newAmbassadors = '${{ needs.detect_ambassador_changes.outputs.newAmbassadors }}'.split(',');
+            const newAmbassadors = process.env.NEW_AMBASSADORS.split(',');
             for (const ambassador of newAmbassadors) {
               try {
                 await github.request('PUT /orgs/{org}/teams/{team_slug}/memberships/{username}', {
@@ -125,13 +139,15 @@
     needs: add_ambassador
     if: needs.add_ambassador.outputs.newAmbassadors != ''
     runs-on: ubuntu-latest
+    env:
+      NEW_AMBASSADORS: ${{ needs.add_ambassador.outputs.newAmbassadors }}
     steps:
       - name: Display welcome message for new ambassadors
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ secrets.GH_TOKEN }}
           script: |
-            const newAmbassadors = "${{ needs.add_ambassador.outputs.newAmbassadors }}".split(",");
+            const newAmbassadors = process.env.NEW_AMBASSADORS.split(",");
             console.log(`New ambassadors: ${newAmbassadors}`);
             const welcomeMessage = newAmbassadors.map((ambassador) => `@${ambassador.trim().replace(/^@/, '')} We invited you to join the AsyncAPI organization, and you are added to the team that lists all Ambassadors.\n
 
@@ -145,13 +161,15 @@
     needs: detect_ambassador_changes
     if: needs.detect_ambassador_changes.outputs.removedAmbassadors != ''
     runs-on: ubuntu-latest
+    env:
+      REMOVED_AMBASSADORS: ${{ needs.detect_ambassador_changes.outputs.removedAmbassadors }}
     steps:
       - name: Remove ambassadors from the organization
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ secrets.GH_TOKEN_ORG_ADMIN }}
           script: |
-            const removedAmbassadors = '${{ needs.detect_ambassador_changes.outputs.removedAmbassadors }}'.split(',');
+            const removedAmbassadors = process.env.REMOVED_AMBASSADORS.split(',');
             for (const ambassador of removedAmbassadors) {
               try {
                 await github.request('DELETE /orgs/{org}/memberships/{username}', {
@@ -175,13 +193,15 @@
     needs: remove_ambassador
     if: needs.remove_ambassador.outputs.removedAmbassadors != ''
     runs-on: ubuntu-latest
+    env:
+      REMOVED_AMBASSADORS: ${{ needs.detect_ambassador_changes.outputs.removedAmbassadors }}
     steps:
       - name: Display goodbye message to removed ambassadors
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ secrets.GH_TOKEN }}
           script: |
-              const removedAmbassadors = "${{ needs.remove_ambassador.outputs.removedAmbassadors }}".split(",");
+              const removedAmbassadors = process.env.REMOVED_AMBASSADORS.split(",");
 
               // Goodbye message to removed ambassadors
               const combinedMessages = removedAmbassadors.map((ambassador) => {
@@ -202,13 +222,17 @@
       GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Install js-yaml
         run: npm install js-yaml@4.1.0
 
       - name: Add Former Ambassador to Emeritus.yaml and print
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          REMOVED_AMBASSADORS: ${{ needs.remove_ambassador.outputs.removedAmbassadors }}
         with:
           script: |
             const fs = require('fs');
@@ -221,8 +245,7 @@
             const content = fs.readFileSync(path, 'utf8').trim(); // remove any trailing whitespaces
 
             // Parse the removedAmbassadors comma-separated string to an array
-            const removedAmbassadors = '${{ needs.remove_ambassador.outputs.removedAmbassadors }}'
-              .split(',')
+            const removedAmbassadors = process.env.REMOVED_AMBASSADORS.split(',')
               .map((ambassador) => ambassador.trim())
               .filter(Boolean);
 
@@ -288,7 +311,7 @@
     runs-on: ubuntu-latest
     steps:
       - name: Report workflow run status to Slack
-        uses: rtCamp/action-slack-notify@v2
+        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
         env:
           SLACK_WEBHOOK: ${{secrets.SLACK_CI_FAIL_NOTIFY}}
           SLACK_TITLE: '🚨 Ambassador Management Workflow failed 🚨'

.github/workflows/automerge-for-humans-add-ready-to-merge-or-do-not-merge-label.yml

@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Add ready-to-merge label
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           GITHUB_ACTOR: ${{ github.actor }}
         with:
@@ -94,7 +94,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Add do-not-merge label
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           # Bot PAT so the `labeled` event can trigger downstream workflows.
           github-token: ${{ secrets.GH_TOKEN }}
@@ -121,7 +121,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Add autoupdate label
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           # Bot PAT so the `labeled` event can trigger the autoupdate workflow.
           github-token: ${{ secrets.GH_TOKEN }}

.github/workflows/automerge-for-humans-merging.yml

@@ -32,7 +32,7 @@ jobs:
     steps:
       - name: Get PR authors
         id: authors
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             // Get paginated list of all commits in the PR
@@ -71,7 +71,7 @@ jobs:
 
       - name: Create commit message
         id: create-commit-message
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           AUTHORS_JSON: ${{ steps.authors.outputs.result }}
         with:

.github/workflows/automerge-for-humans-remove-ready-to-merge-label-on-edit.yml

@@ -21,7 +21,7 @@ jobs:
       pull-requests: write # required to remove labels and post comments on PR issues 
     steps:
       - name: Remove label
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ github.token }}
           script: |

.github/workflows/automerge-orphans.yml

@@ -19,11 +19,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Get list of orphans
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         id: orphans
         with:
           github-token: ${{ github.token }}

.github/workflows/automerge.yml

@@ -26,7 +26,7 @@ jobs:
           github-token: "${{ secrets.GH_TOKEN_BOT_EVE }}"
 
       - name: Label autoapproved
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ secrets.GH_TOKEN }}
           script: |

.github/workflows/bounty-program-commands.yml

@@ -38,7 +38,7 @@ jobs:
 
     steps:
       - name: ❌ @${{github.actor}} made an unauthorized attempt to use a Bounty Program's command
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           ACTOR: ${{ github.actor }}
         with:
@@ -69,7 +69,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Add label `bounty`
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ github.token }}
           script: |
@@ -112,7 +112,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Remove label `bounty`
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ github.token }}
           script: |

.github/workflows/cancel-event.yml

@@ -4,7 +4,8 @@ on:
   issues:
     types:
       - closed
-
+permissions:
+  issues: write # needs write permissions to be able to add a comment to the issue when event was cancelled and to read the issue details
 jobs:
 
   cancel_event:
@@ -15,16 +16,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           cache-dependency-path: '**/package-lock.json'
       - name: Install deps
         run: npm install
         working-directory: ./.github/workflows/create-event-helpers
       - name: Remove Google Calendar entry
-        uses: actions/github-script@v4
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
           ISSUE_CLOSED_AT: ${{ github.event.issue.closed_at }}

.github/workflows/create-event-ad-hoc.yml

@@ -18,7 +18,7 @@ on:
       meeting_banner: 
         description: 'Meeting banner(image) URL'
         required: false
-
+permissions: {}  # write permissions are defined in the create-event-workflow-reusable.yml workflow
 jobs:
 
   setup-ad-hoc:

.github/workflows/create-event-community-meeting.yml

@@ -12,7 +12,7 @@ on:
       meeting_banner:
         description: 'Meeting banner(image) URL'
         required: false
-
+permissions: {}  # write permissions are defined in the create-event-workflow-reusable.yml workflow
 jobs:
   setup-community-meeting:
     uses: ./.github/workflows/create-event-workflow-reusable.yml

.github/workflows/create-event-lets-talk-about.yml

@@ -16,6 +16,9 @@ on:
       meeting_banner:
         description: 'Meeting banner(image) URL'
         required: false
+
+permissions: {}  # write permissions are defined in the create-event-workflow-reusable.yml workflow
+
 jobs:
   setup-lets-talk-about-contrib-stream:
     uses: ./.github/workflows/create-event-workflow-reusable.yml

.github/workflows/create-event-spec-3-0.yml

@@ -12,7 +12,7 @@ on:
       meeting_banner:
         description: 'Meeting banner(image) URL'
         required: false
-
+permissions: {}  # write permissions are defined in the create-event-workflow-reusable.yml workflow
 jobs:
 
   setup-spec-3-0-meeting: