ci(security): pin actions to SHAs, least-privilege permissions, verify gitleaks (P2, lane 21)

- Pin every third-party action to an immutable commit SHA (with a # vN comment)
  in ci.yml, secret-scan.yml, license-check.yml, docker-publish.yml. Mutable
  major tags (actions/checkout@v6 etc.) can be silently re-pointed by a
  compromised upstream. Dependabot keeps SHAs current.
- Add `permissions: contents: read` to ci.yml, secret-scan.yml, license-check.yml
  so jobs don't inherit a write-capable GITHUB_TOKEN from the repo default.
  (docker-publish.yml already scopes contents:read + packages:write per job.)
- secret-scan.yml: verify the downloaded gitleaks tarball against the published
  SHA256 checksum before extracting/executing it.
- Add .github/CODEOWNERS requiring owner review on .github/ changes.

Addresses lane 21 MEDIUMs (permissions, SHA-pinning, unverified gitleaks
download) + LOW (CODEOWNERS).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: KingArthur000 <sathyaprakashelango@gmail.com>

Author: sathyaprakash000

.github/CODEOWNERS

@@ -0,0 +1,7 @@
+# Code owners — GitHub requests review from these owners on matching changes.
+#
+# CI/CD and automation config is security-sensitive (workflow permissions,
+# pinned action SHAs, secret scanning). Require the repo owner's review on any
+# change under .github/ so a privilege-escalating workflow edit can't merge
+# unreviewed. Enforce via a branch-protection rule requiring CODEOWNERS review.
+/.github/ @KingArthur000

.github/workflows/ci.yml

@@ -6,13 +6,18 @@ on:
   pull_request:
     branches: [main]
 
+# Least privilege: CI only needs to read the repo. Override the repo-wide
+# default (which may be "read and write") so a compromised action can't push.
+permissions:
+  contents: read
+
 jobs:
   backend:
     name: Backend (install + syntax check)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: '20'
           cache: 'npm'
@@ -36,8 +41,8 @@ jobs:
     name: Frontend (build)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: '20'
           cache: 'npm'
@@ -67,7 +72,7 @@ jobs:
           --health-cmd "pg_isready -U postgres"
           --health-interval 5s --health-timeout 5s --health-retries 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Apply every migration in order against a fresh DB
         env:
           PGPASSWORD: ci
@@ -85,7 +90,7 @@ jobs:
     name: Secret scan (reject obvious tokens)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with: { fetch-depth: 0 }
       - name: Grep for high-confidence secret patterns
         run: |

.github/workflows/docker-publish.yml

@@ -30,20 +30,20 @@ jobs:
           - name: frontend
             context: ./frontend
     steps:
-      - uses: actions/checkout@v6
-      - uses: docker/login-action@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/metadata-action@v6
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
         id: meta
         with:
           images: ghcr.io/${{ github.repository }}-${{ matrix.name }}
           tags: |
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
-      - uses: docker/build-push-action@v7
+      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
         with:
           context: ${{ matrix.context }}
           push: true

.github/workflows/license-check.yml

@@ -12,6 +12,9 @@ name: License Check
 
 on: [pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   licenses:
     name: Licenses (${{ matrix.dir }})
@@ -21,8 +24,8 @@ jobs:
       matrix:
         dir: [backend, frontend]
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: '20'
       - name: Install ${{ matrix.dir }} production dependencies

.github/workflows/secret-scan.yml

@@ -14,17 +14,23 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   gitleaks:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0   # full history
       - name: Run gitleaks
         env:
           GITLEAKS_VERSION: "8.18.4"
         run: |
           curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" -o gitleaks.tar.gz
+          # Verify the download against the published checksum before executing it.
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_checksums.txt" -o checksums.txt
+          grep "gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" checksums.txt | sha256sum -c -
           tar -xzf gitleaks.tar.gz gitleaks
           ./gitleaks detect --source . --redact --verbose --exit-code 1