ci: add GitHub Actions security audit script

[zackverham]

Summary

This is the result of working through a suggestion proposed by @dotNomad to capture some of the improvements we made to tidy up our github actions. Those best practices are things we want to continue to maintain moving forward, so this script helps us to mitigate drift over time. It also is something that we could probably apply to other repositories, if we can figure out the right set of validations here.

I don't have any ideas on how often we want to run this, or where the results should live, or anything like that. But it does capture the work in a set of repeatable checks that we can kick off via a github action manually, which is nice.

---

Adds a Python script to audit GitHub Actions workflows for common security best practices. This script captures the security hardening improvements that have been applied to this repository, making them repeatable and auditable.

Security Checks

The script checks for 8 categories of security issues:

Check	Description
1. Explicit permissions	All workflows should declare minimum required permissions
2. No secrets: inherit	Pass secrets explicitly to limit exposure
3. Fork PR protection	Jobs using secrets should skip fork PRs
4. Tag ancestry verification	Tag-triggered releases should verify tag is on main
5. workflow_dispatch protection	Publish/release workflows need environment protection
6. Overly permissive	No write-all or unnecessary contents: write
7. Pinned actions	Don't use @main or @master for external actions
8. Dangerous patterns	No untrusted input injection, no risky pull_request_target

Usage

# Run the audit
python scripts/audit_gha_security.py

# Run tests
cd scripts && python -m unittest test_audit_gha_security -v

Current Results

Running against this repo's workflows shows 3 warnings (no errors):

• nightly-prerelease.yaml: Missing tag ancestry verification
• nightly-prerelease.yaml: Has workflow_dispatch without environment protection
• e2e.yaml: Uses posit-dev/with-connect@main (unpinned action)

Test plan

• All 28 unit tests pass
• Script runs successfully against current workflows
• Can be used to audit other repositories

🤖 Generated with Claude Code