fix(ci): put the write permission on the job that writes, and audit egress

Three findings from the PR head's own checks, all on the gate this PR adds:

  * Hypatia WH013 (error — this is what fails the Hypatia check): the
    workflow performs a push/commit/PR but granted no `contents: write`
    anywhere, so the write would be denied at run time. Fixed by declaring
    `contents: write` on the relock job, which is the only job that writes.
  * SonarCloud githubactions:S8233 (MAJOR vulnerability — this is the single
    issue failing the Quality Gate on this PR): "Move this write permission
    from workflow level to job level". The workflow-level
    `pull-requests: write` is now on the relock job too, and the workflow
    level is `contents: read` only.
  * Hypatia RE001 (warning, three jobs): any job that reaches for secrets.*
    should install step-security/harden-runner. Added with
    `egress-policy: audit` to both gate jobs and to the release job, which
    holds the release token.

actions.lock regenerated for the one new ref:
step-security/harden-runner@e14015d5 (v2.21.1), owner 88700172, repo
422287306 — the same ids hyperpolymath/standards records for it. The estate
validator now reports 17 refs checked against 17 lockfile keys, 0 errors.

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>

Author: hyperpolymath

.github/workflows/actions-lock.yml

@@ -47,7 +47,6 @@ on:
 
 permissions:
   contents: read
-  pull-requests: write
 
 concurrency:
   group: actions-lockfile-${{ github.ref }}
@@ -63,13 +62,22 @@ jobs:
     name: Verify actions.lock
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    permissions:
+      contents: read
     outputs:
       # `relock` is computed in the shell, not in an `if:` expression:
       # `inputs.mode` is not a recognised named value outside
       # workflow_dispatch, and referencing it there is a start-up error.
       in_sync: ${{ steps.check.outputs.in_sync }}
       relock: ${{ steps.check.outputs.relock }}
     steps:
+      # Egress audit: Hypatia's RE001 asks for it on any job that reaches for
+      # secrets.*, and both jobs here pass GITHUB_TOKEN to gh.
+      - name: Harden runner (egress audit)
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
       - name: Checkout
         id: checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -147,6 +155,12 @@ jobs:
     if: always() && needs.verify.outputs.relock == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    # The write lives here, on the only job that writes. `contents: write` is
+    # what lets the PAT-backed push land, and `pull-requests: write` is what
+    # lets the fallback publish the regenerated file as a comment.
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Decide where the fix goes
         id: target
@@ -186,6 +200,13 @@ jobs:
             fi
           fi
 
+      # Egress audit: Hypatia's RE001 asks for it on any job that reaches for
+      # secrets.*, and both jobs here pass GITHUB_TOKEN to gh.
+      - name: Harden runner (egress audit)
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
       - name: Checkout the branch that needs the lockfile
         id: checkout-lock
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/actions.lock

@@ -8,6 +8,7 @@ workflows:
     '.github/workflows/actions-lock.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
         - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+        - 'step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1'
     '.github/workflows/boj-build.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
     '.github/workflows/casket-pages.yml':
@@ -44,6 +45,7 @@ workflows:
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
         - 'actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c'
         - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+        - 'step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1'
     '.github/workflows/rhodibot.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
     '.github/workflows/scorecard.yml': []
@@ -138,3 +140,8 @@ dependencies:
         commit: 'sha1-22e7bdb322c430c1d0dac6b3bb307f4bb139d0be'
         owner_id: 6759885
         repo_id: 1352485172
+    'step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1':
+        ref: 'v2.21.1'
+        commit: 'sha1-e14015d583714f6e62063499dc959a02595150a1'
+        owner_id: 88700172
+        repo_id: 422287306

.github/workflows/release.yml

@@ -100,6 +100,13 @@ jobs:
       id-token: write
       attestations: write
     steps:
+      # Egress audit. Hypatia's RE001 flags any job that reaches for secrets.*
+      # without installing harden-runner, and this one holds the release token.
+      - name: Harden runner (egress audit)
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1