Harden CI/CD for trusted publishing (ENG-5308)

- Switch from API token auth to PyPI trusted publishing (OIDC)
  - Add id-token: write permission for OIDC token generation
  - Remove UV_PUBLISH_TOKEN secret references; uv publish uses OIDC
  - Add GitHub environment (pypi/testpypi) for deployment protection rules
- Pin all GitHub Actions to immutable commit SHAs
- Add branch guard: publish job only runs from main
- Set deny-by-default permissions at workflow level (permissions: {})
- Add SLSA build provenance attestation via attest-build-provenance
- Add attestations: write permission for provenance generation

Co-authored-by: Andrew Suter-Morris <asutermo@users.noreply.github.com>

Author: cursoragent

.github/workflows/publish.yml

@@ -14,30 +14,36 @@ on:
       use_testpypi:
         description: 'Use TestPyPI for testing'
         required: false
-        default: false # Change to true when testing publish workflow
+        default: false
         type: boolean
 
+permissions: {}
+
 concurrency:
   group: publish-pypi
   cancel-in-progress: false
 
 jobs:
   publish:
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
+    environment: ${{ github.event.inputs.use_testpypi == 'true' && 'testpypi' || 'pypi' }}
     permissions:
-      contents: write  # Needed for creating releases
+      contents: write
+      id-token: write
+      attestations: write
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.8'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4
         with:
           version: "latest"
 
@@ -69,13 +75,11 @@ jobs:
             echo "repository_name=TestPyPI" >> $GITHUB_OUTPUT
             echo "publish_url=https://test.pypi.org/legacy/" >> $GITHUB_OUTPUT
             echo "view_url=https://test.pypi.org/project/freeplay" >> $GITHUB_OUTPUT
-            echo "token_secret=TEST_PYPI_API_TOKEN" >> $GITHUB_OUTPUT
           else
             echo "repository=pypi" >> $GITHUB_OUTPUT
             echo "repository_name=PyPI" >> $GITHUB_OUTPUT
             echo "publish_url=https://upload.pypi.org/legacy/" >> $GITHUB_OUTPUT
             echo "view_url=https://pypi.org/project/freeplay" >> $GITHUB_OUTPUT
-            echo "token_secret=PYPI_API_TOKEN" >> $GITHUB_OUTPUT
           fi
         
       - name: Get latest version from repository
@@ -117,27 +121,24 @@ jobs:
         run: |
           echo "Built packages:"
           ls -la dist/
-          
+
+      - name: Generate build provenance attestation
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4
+        with:
+          subject-path: dist/*
+
       - name: Publish to TestPyPI
         if: steps.repo_config.outputs.repository == 'testpypi'
         env:
-          UV_PUBLISH_TOKEN: ${{ secrets.TEST_PYPI_API_TOKEN }}
-          UV_PUBLISH_URL: ${{ steps.repo_config.outputs.publish_url }}
-        run: |
-          echo "🧪 Publishing to TestPyPI for testing..."
-          uv publish
+          UV_PUBLISH_URL: https://test.pypi.org/legacy/
+        run: uv publish
 
       - name: Publish to PyPI
         if: steps.repo_config.outputs.repository != 'testpypi'
-        env:
-          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
-          UV_PUBLISH_URL: ${{ steps.repo_config.outputs.publish_url }}
-        run: |
-          echo "📦 Publishing to PyPI..."
-          uv publish
+        run: uv publish
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2
         with:
           tag_name: v${{ steps.version.outputs.version }}
           name: Release v${{ steps.version.outputs.version }}

.github/workflows/test.yml

@@ -6,6 +6,8 @@ on:
   pull_request:
     branches: [main]
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -18,21 +20,21 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.8'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4
         with:
           version: "latest"
 
       - name: Load cached venv
         id: cached-uv-dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: .venv
           key: venv-${{ runner.os }}-${{ hashFiles('**/uv.lock') }}
@@ -48,4 +50,4 @@ jobs:
         run: make lint-check
 
       - name: Run tests (PR)
-        run: make test-ci
+        run: make test-ci