Misc GitHub Actions hardening

.github/dependabot.yml

@@ -7,11 +7,15 @@ updates:
     open-pull-requests-limit: 10
     labels:
       - scope:distribution
+    cooldown:
+      default-days: 7
   - package-ecosystem: github-actions
     directory: "/"
     schedule:
       interval: daily
     open-pull-requests-limit: 10
     labels:
       - scope:distribution
+    cooldown:
+      default-days: 7
 

.github/workflows/reusable-check-branch-alias.yml

@@ -31,6 +31,8 @@ jobs:
         with:
           fetch-depth: 0 # Fetch all history for all tags
           token: ${{ secrets.GITHUB_TOKEN }}
+          # To be able to push changes.
+          persist-credentials: true
 
       - name: Set up PHP
         uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
@@ -142,28 +144,30 @@ jobs:
             - Updated branch-alias: `${{ steps.check_alias.outputs.expected_alias }}`
 
             The branch-alias should point to the major development version for the latest major release.
+          STEPS_CHECK_ALIAS_OUTPUTS_EXPECTED_ALIAS: ${{ steps.check_alias.outputs.expected_alias }}
+          GITHUB_EVENT_REPOSITORY_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
         run: |
           if [ -n "$(git status --porcelain)" ]; then
             git config user.name "github-actions[bot]"
             git config user.email "github-actions[bot]@users.noreply.github.com"
             git checkout -b update-branch-alias
             git add composer.json
-            git commit -m "Update branch-alias to ${{ steps.check_alias.outputs.expected_alias }}"
+            git commit -m "Update branch-alias to ${STEPS_CHECK_ALIAS_OUTPUTS_EXPECTED_ALIAS}"
             git push -f origin update-branch-alias
 
             PR_NUMBER=$(gh pr list --head update-branch-alias --json number --jq '.[0].number // empty')
             if [ -z "$PR_NUMBER" ]; then
               gh pr create \
-                --title "Update branch-alias to ${{ steps.check_alias.outputs.expected_alias }}" \
+                --title "Update branch-alias to ${STEPS_CHECK_ALIAS_OUTPUTS_EXPECTED_ALIAS}" \
                 --body "$PR_BODY" \
                 --label "automated-pr" \
-                --base "${{ github.event.repository.default_branch }}" \
+                --base "${GITHUB_EVENT_REPOSITORY_DEFAULT_BRANCH}" \
                 --head "update-branch-alias"
             else
               gh pr edit "$PR_NUMBER" \
-                --title "Update branch-alias to ${{ steps.check_alias.outputs.expected_alias }}" \
+                --title "Update branch-alias to ${STEPS_CHECK_ALIAS_OUTPUTS_EXPECTED_ALIAS}" \
                 --body "$PR_BODY" \
                 --add-label "automated-pr" \
-                --base "${{ github.event.repository.default_branch }}"
+                --base "${GITHUB_EVENT_REPOSITORY_DEFAULT_BRANCH}"
             fi
           fi

.github/workflows/reusable-regenerate-readme.yml

@@ -23,6 +23,9 @@ jobs:
     steps:
       - name: Check out source code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # To be able to push changes.
+          persist-credentials: true
 
       - name: Set up PHP environment
         uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
@@ -61,6 +64,7 @@ jobs:
             **This is an automated pull-request**
 
             Refreshes the `README.md` file with the latest changes to the docblocks in the source code.
+          GITHUB_EVENT_REPOSITORY_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
         run: |
           if [ -n "$(git status --porcelain)" ]; then
             git config user.name "github-actions[bot]"
@@ -76,13 +80,13 @@ jobs:
                 --title "Regenerate README file" \
                 --body "$PR_BODY" \
                 --label "scope:documentation" \
-                --base "${{ github.event.repository.default_branch }}" \
+                --base "${GITHUB_EVENT_REPOSITORY_DEFAULT_BRANCH}" \
                 --head "regenerate-readme"
             else
               gh pr edit "$PR_NUMBER" \
                 --title "Regenerate README file" \
                 --body "$PR_BODY" \
                 --add-label "scope:documentation" \
-                --base "${{ github.event.repository.default_branch }}"
+                --base "${GITHUB_EVENT_REPOSITORY_DEFAULT_BRANCH}"
             fi
           fi

.github/workflows/sync-workflows.yml

@@ -10,14 +10,16 @@ on:
     - cron:  '*/10 * * * *' # Run every 10 minutes.
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
 
   sync-workflows:
     name: Sync GitHub Actions workflows
     runs-on: ubuntu-latest
     if: ${{ github.repository_owner == 'wp-cli' }}
+    permissions:
+      contents: write
     steps:
       - name: Sync files
         uses: adrianjost/files-sync-action@55d577a25b7106ebc3001353d981ecf8b0150df4 # v2.1.0
@@ -83,6 +85,8 @@ jobs:
     name: Sync Dependabot configuration
     runs-on: ubuntu-latest
     if: ${{ github.repository_owner == 'wp-cli' }}
+    permissions:
+      contents: write
     steps:
       - name: Sync files
         uses: adrianjost/files-sync-action@55d577a25b7106ebc3001353d981ecf8b0150df4 # v2.1.0