[bhimrazy]

What does this PR do?

Hardens the GitHub Actions workflows based on a zizmor scan (1 high, 21 medium, 7 low findings → none).

• Least-privilege permissions: on every workflow; write access only where a job needs it (docs-deploy, upload-release-assets, greetings, cleanup-caches).
• persist-credentials: false on every checkout except docs-deploy, which pushes to gh-pages.
• Pins actions/setup-go to a commit, and passes the Lightning-AI/utilities commit as actions-ref instead of main.
• cleanup-caches uses the built-in gh cache delete instead of installing the archived gh-actions-cache extension.
• 7-day Dependabot cooldown, and fixes the wrong # v6.0.2 comment on the checkout pin in docs-build.

Details

• actions-ref: main: check-typing and check-package check out Lightning-AI/utilities at this ref and run its composite actions, so the workflow's commit pin didn't cover that code. The other shared workflows leave actions-ref empty and don't fetch it.
• Shared workflows in ci-checks / docs-build use no token beyond reading the repo, so contents: read at the caller is enough.
• cleanup-caches now skips fork PRs: their token is read-only, so the old script's deletes already failed silently there (set +e).
• Dependabot cooldown delays version-update PRs for a new release by 7 days, so a compromised release has time to be caught before it's proposed. Security updates are not delayed.
• Doesn't conflict with chore(deps): bump the gha-updates group with 3 updates #948 (Dependabot action bumps): checked with git merge-tree.
• Not in this PR: adding a pypi environment with required reviewers to publish-pypi. It needs admin setup in repo settings and on PyPI's trusted publisher, so it's left as a follow-up.
• Pedantic-mode leftovers (unnamed jobs, missing job-level concurrency, a non-exploitable ${{ needs.pytester.result }} echo) are left as is.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82%. Comparing base (c6f075c) to head (05195f0).
⚠️ Report is 1 commits behind head on main.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@          Coverage Diff          @@
##            main    #956   +/-   ##
=====================================
  Coverage     82%     82%           
=====================================
  Files         72      72           
  Lines      16445   16445           
=====================================
  Hits       13505   13505           
  Misses      2940    2940           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

🟢 Approval recommended

No active review issues are identified for the workflow security-hardening changes.

No open issues 🎉

What changed in this PR

Hardens litData’s GitHub Actions workflows against zizmor findings by restricting token permissions, reducing persisted credentials, and pinning executable dependencies.

Changes:

• Sets explicit token permissions and disables checkout credential persistence except for documentation deployment.
• Pins Go setup and shared-action references; replaces the cache-cleanup extension with the built-in GitHub CLI command and skips fork PRs.
• Adds seven-day Dependabot cooldowns and corrects the documentation checkout’s version comment.

File	Description
.github/​workflows/​torch-policy.yml	Disables checkout credential persistence.
.github/​workflows/​release-pypi.yml	Scopes build and release permissions; disables persisted checkout credentials.
.github/​workflows/​greetings.yml	Limits the greeting job to issue-write access.
.github/​workflows/​docs-build.yml	Scopes deployment write access, explicitly retains credentials, and corrects a version comment.
.github/​workflows/​cleanup-caches.yml	Uses built-in cache deletion with scoped permissions and skips fork PRs.
.github/​workflows/​ci-testing.yml	Sets read-only permissions and disables persisted checkout credentials.
.github/​workflows/​ci-litsim.yml	Pins Go setup and restricts permissions and credential persistence.
.github/​workflows/​ci-checks.yml	Sets read-only permissions and pins shared-action references.
.github/​dependabot.yml	Adds seven-day cooldowns for dependency and action updates.

_{Review effort: Balanced}

[deependujha]

nice work. Do you think we should consider adding a minimal CI or pre-commit or something that looks for security issues in CI workflow files?

[bhimrazy]

nice work. Do you think we should consider adding a minimal CI or pre-commit or something that looks for security issues in CI workflow files?

Thanks! yeah, maybe we could add it in the pre-commit file, but I wouldn't recommend adding it as a CI action.