fix: harden CI/CD workflows per zizmor audit

[KeremP]

Summary

Remediate all findings from zizmor static analysis across both GitHub Actions workflow files.

ci.yml:

• Added permissions: {} at workflow level and permissions: { contents: read } at job level (excessive-permissions)
• Added persist-credentials: false to checkout (artipacked)
• Pinned actions/checkout and actions/setup-node to SHA hashes (unpinned-uses)

release.yml:

• Added persist-credentials: false to checkout (artipacked)
• Pinned actions/checkout and actions/setup-node to SHA hashes (unpinned-uses)
• Added environment: release to the job (secrets-outside-env) — you'll need to create a "release" environment in your repo's Settings > Environments and add the NPM_TOKEN secret there
• Replaced all ${{ steps.check.outputs.* }} in run: blocks with env: variables (template-injection)
• Replaced softprops/action-gh-release with gh release create (superfluous-actions, unpinned-uses, cache-poisoning)

Test plan

• zizmor . reports 0 findings (5 suppressed)
• Verify CI workflow still passes on PRs
• Create "release" environment in repo settings and move NPM_TOKEN secret there
• Test a release cycle end-to-end

---

Note

Medium Risk
Touches CI/release automation and permissioning; mistakes could block releases or tagging, but changes are largely security hardening and action pinning.

Overview
Hardens GitHub Actions CI and release workflows per security audit findings.

CI now defaults to permissions: {} with job-scoped contents: read, pins actions/checkout/actions/setup-node to SHAs, and disables checkout credential persistence.

Release now runs in a protected environment: release, avoids expression interpolation inside shell scripts by moving values to env, and replaces softprops/action-gh-release with direct gh release create using GH_TOKEN for publishing GitHub releases.

^{Written by Cursor Bugbot for commit 6025e28. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: persist-credentials: false breaks git push in release workflow
  • Removed persist-credentials: false from release workflow checkout step to allow git push operations to authenticate using the default persisted credentials.