improve github actions security

Author: stijnvanhulle

.github/workflows/cleanup-branches.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Delete merged branch
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const branch = context.payload.pull_request.head.ref;

.github/workflows/copilot-setup-steps.yml

@@ -11,6 +11,8 @@ on:
     paths:
       - .github/workflows/copilot-setup-steps.yml
 
+permissions: {}
+
 jobs:
   # The job MUST be called `copilot-setup-steps` or it will not be picked up by Copilot.
   copilot-setup-steps:
@@ -21,7 +23,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Tools
         uses: kubb-labs/config/.github/setup@main

.github/workflows/docker-agent.yml

@@ -20,6 +20,8 @@ env:
   REGISTRY_DOCKER: docker.io
   IMAGE_NAME: kubb-agent
 
+permissions: {}
+
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
@@ -41,30 +43,30 @@ jobs:
           node-version: '22'
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Build
         run: pnpm run build
 
       - name: Log in to GitHub Container Registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY_GHCR }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Log in to Docker Hub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY_DOCKER }}
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             ${{ env.REGISTRY_GHCR }}/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}
@@ -81,7 +83,7 @@ jobs:
 
       - name: Build and push Docker image
         id: push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: ./packages/agent
           file: ./packages/agent/Dockerfile
@@ -96,7 +98,7 @@ jobs:
 
       - name: Generate artifact attestation
         if: github.event_name != 'pull_request'
-        uses: actions/attest-build-provenance@v3
+        uses: actions/attest-build-provenance@v4
         continue-on-error: true
         with:
           subject-name: ${{ env.REGISTRY_GHCR }}/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}

.github/workflows/labeler.yml

@@ -2,6 +2,8 @@ name: Labeler
 on:
   - pull_request_target
 
+permissions: {}
+
 jobs:
   labeler:
     permissions:

.github/workflows/pr.yml

@@ -81,7 +81,7 @@ jobs:
 
       - name: Upload coverage reports to Codecov
         if: ${{ !cancelled() }}
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v6
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
@@ -240,7 +240,7 @@ jobs:
 
       - name: Create Pull Request with generated files
         if: github.event.pull_request.head.repo.full_name == github.repository
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@v8
         with:
           base: ${{ github.head_ref || github.ref_name }}
           branch: chore/update-generated-examples-${{ github.event.number }}

.github/workflows/release.yml

@@ -15,7 +15,6 @@ permissions:
   actions: write
   contents: write
   id-token: write
-  models: read
   packages: write
   pull-requests: write
   issues: write
@@ -51,7 +50,7 @@ jobs:
         run: pnpm run test
 
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v6
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
@@ -63,23 +62,22 @@ jobs:
           publish: pnpm release
           commit: "ci(changesets): version packages"
           setupGitUser: false
+          setupNpmrc: false
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_CONFIG_PROVENANCE: true
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Publish ${{ inputs.tag || 'canary' }}
         id: canary
         if: steps.changesets.outputs.published != 'true'
-        run: |
-          git checkout main
-          pnpm version:canary
-          pnpm release:canary --tag ${{ inputs.tag || 'canary' }}
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NPM_CONFIG_PROVENANCE: true
+          RELEASE_TAG: ${{ inputs.tag || 'canary' }}
+        run: |
+          git checkout main
+          pnpm version:canary
+          pnpm release:canary --tag "$RELEASE_TAG"
 
   get-version:
     name: Get Published Version
@@ -91,7 +89,7 @@ jobs:
     steps:
       - name: Get version
         id: version
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           PUBLISHED_PACKAGES: ${{ needs.release.outputs.published_packages }}
         with:
@@ -118,7 +116,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Send a discord notification
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
           PUBLISHED_PACKAGES: ${{ needs.release.outputs.published_packages }}

.github/workflows/update-agents-skills.yml

@@ -17,15 +17,15 @@ jobs:
   build-agents-md:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Generate skills block
         id: build
-        uses: dave1010/skills-to-agents@v1
+        uses: dave1010/skills-to-agents@v2
         with:
           repo-root: .
           skills-dir: .skills
           agents-path: AGENTS.md
-      - uses: peter-evans/create-pull-request@v7
+      - uses: peter-evans/create-pull-request@v8
         if: steps.build.outputs.changed == 'true'
         with:
           base: ${{ github.head_ref || github.ref_name }}

.npmrc

@@ -1,2 +1 @@
 registry=https://registry.npmjs.org/
-package-manager-strict=false

package.json

@@ -72,13 +72,8 @@
   },
   "engines": {
     "node": ">=22",
-    "pnpm": ">=10.0.0"
-  },
-  "packageManager": "pnpm@10.33.3",
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "esbuild"
-    ]
+    "pnpm": ">=11.0.0"
   },
+  "packageManager": "pnpm@11.0.5",
   "namespace": "@kubb"
 }

pnpm-workspace.yaml

@@ -4,6 +4,12 @@ packages:
   - examples/*
   - tests/**
 
+allowBuilds:
+  esbuild: true
+
+pmOnFail: warn
+minimumReleaseAge: 0
+
 catalog:
   '@kubb/adapter-oas': 5.0.0-beta.4
   '@kubb/agent': 5.0.0-beta.4