Misc GitHub Actions hardening

[swissspidy]

Summary by CodeRabbit

• Chores
  • Improved automated dependency update scheduling by adding a seven-day cooldown.
  • Strengthened workflow security by reducing default repository permissions and granting write access only where needed.
  • Reduced credential exposure during automated repository checkouts by enabling credential persistence for required steps only.
  • Improved reliability of automated branch-alias, README regeneration, and workflow synchronization by refining checkout and PR base handling.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: fc51bc2b-5ef9-4b7b-bb96-86784922fdf0

📥 Commits

Reviewing files that changed from the base of the PR and between ea65e9d and a5fd116.

📒 Files selected for processing (2)

• .github/workflows/reusable-check-branch-alias.yml
• .github/workflows/reusable-regenerate-readme.yml

---

📝 Walkthrough

Walkthrough

Dependabot schedules now include seven-day cooldowns. Reusable workflows persist checkout credentials and use environment variables for pull request branch values. Workflow contents permissions are restricted globally and restored only for jobs requiring write access.

Changes

CI configuration updates

Layer / File(s)	Summary
Dependabot cooldown settings .github/dependabot.yml	Composer and GitHub Actions update entries add a seven-day default cooldown.
Workflow pull request automation .github/workflows/reusable-check-branch-alias.yml, .github/workflows/reusable-regenerate-readme.yml	Reusable workflows persist checkout credentials and use environment variables for pull request branch values.
Workflow permission scoping .github/workflows/sync-workflows.yml	Workflow-wide contents access is reduced to read-only, with write access granted at the sync-workflows and sync-dependabot job levels.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: schlessera

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and matches the main theme of the changes: hardening GitHub Actions and related automation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/gha-hardening

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

.github/workflows/sync-workflows.yml (1)

13-22: 🔒 Security & Privacy | 🔵 Trivial

Verify the scope of the token actually used by the sync action.

Workflow permissions scopes GitHub’s automatically issued GITHUB_TOKEN, but both jobs pass secrets.ACTIONS_BOT under that environment name at Lines 82 and 143. Therefore, the new permission restrictions do not constrain that cross-repository credential. Confirm it is least-privileged, ideally using a GitHub App token restricted to the required repositories and contents/workflow permissions. (docs.github.com)

Also applies to: 88-89

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/sync-workflows.yml around lines 13 - 22, Update the
credentials used by the sync-workflows jobs at the ACTIONS_BOT references so the
cross-repository token is least-privileged and limited to only the required
repositories with contents/workflow access, preferably via a GitHub App token.
Ensure the token’s actual scopes are independently restricted rather than
relying only on the workflow permissions block.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/reusable-check-branch-alias.yml:
- Line 34: Both reusable workflows disable persisted checkout credentials, so
authenticate Git before pushing: in
.github/workflows/reusable-check-branch-alias.yml at lines 34-34, add gh auth
setup-git before git push -f origin update-branch-alias; in
.github/workflows/reusable-regenerate-readme.yml at lines 26-27, add the same
authentication step before git push -f origin regenerate-readme.

---

Nitpick comments:
In @.github/workflows/sync-workflows.yml:
- Around line 13-22: Update the credentials used by the sync-workflows jobs at
the ACTIONS_BOT references so the cross-repository token is least-privileged and
limited to only the required repositories with contents/workflow access,
preferably via a GitHub App token. Ensure the token’s actual scopes are
independently restricted rather than relying only on the workflow permissions
block.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 4d282610-f480-4bae-a52e-ea20e3406d8b

📥 Commits

Reviewing files that changed from the base of the PR and between 8affb8a and ea65e9d.

📒 Files selected for processing (4)

• .github/dependabot.yml
• .github/workflows/reusable-check-branch-alias.yml
• .github/workflows/reusable-regenerate-readme.yml
• .github/workflows/sync-workflows.yml