ci: harden gh actions

.github/actions/playwright-install/action.yml

@@ -10,7 +10,7 @@ runs:
       shell: bash
     - name: Cache Playwright browsers
       id: playwright-cache
-      uses: actions/cache@v5
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
       with:
         path: ~/.cache/ms-playwright
         key: playwright-${{ runner.os }}-${{ steps.playwright-version.outputs.version }}

.github/workflows/api-snapshot.yml

@@ -15,11 +15,10 @@ jobs:
   api-snapshot:
     name: API Snapshot
     runs-on: ubuntu-latest
-    env:
-      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-      TURBO_TEAM: rocicorp
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x

.github/workflows/bencher-benchmarks-pr.yml

@@ -8,12 +8,17 @@ jobs:
   playwright-install:
     name: Install Playwright
     if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: self-hosted
+    permissions:
+      contents: read
+    runs-on: [self-hosted, benchmark]
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x
+          cache: 'npm'
       - run: npm ci
       - uses: ./.github/actions/playwright-install
 
@@ -49,4 +54,3 @@ jobs:
       base_sha: ${{ github.event.pull_request.base.sha }}
     secrets:
       BENCHER_API_TOKEN: ${{ secrets.BENCHER_API_TOKEN }}
-      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}

.github/workflows/bencher-benchmarks.yml

@@ -7,9 +7,13 @@ on:
 jobs:
   playwright-install:
     name: Install Playwright
-    runs-on: self-hosted
+    permissions:
+      contents: read
+    runs-on: [self-hosted, benchmark]
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x

.github/workflows/bencher-file-sizes-pr.yml

@@ -17,4 +17,3 @@ jobs:
       base_sha: ${{ github.event.pull_request.base.sha }}
     secrets:
       BENCHER_API_TOKEN: ${{ secrets.BENCHER_API_TOKEN }}
-      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}

.github/workflows/bundle-sizes.js.yml

@@ -6,12 +6,19 @@ on:
     paths:
       - 'packages/replicache/**'
 
+permissions:
+  contents: read
+
 jobs:
-  bundle-size:
-    name: Bundle Sizes Check
+  measure:
+    name: Measure bundle sizes
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x
@@ -25,6 +32,31 @@ jobs:
         run: npx tsx tool/bundle-sizes.ts --bundles replicache.mjs replicache.mjs.br replicache.min.mjs replicache.min.mjs.br | tee bundle-sizes.json
         working-directory: packages/replicache
 
+      - name: Upload bundle size output
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: bundle-size-output
+          path: packages/replicache/bundle-sizes.json
+          if-no-files-found: error
+          retention-days: 1
+
+  publish:
+    name: Publish bundle sizes
+    needs: measure
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - name: Download bundle size output
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        with:
+          name: bundle-size-output
+          path: packages/replicache
+
       # Run `github-action-benchmark` action
       - name: Store bundle size
         uses: rhysd/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1
@@ -33,7 +65,7 @@ jobs:
           tool: 'customSmallerIsBetter'
           output-file-path: packages/replicache/bundle-sizes.json
           fail-on-alert: true
-          github-token: ${{ secrets.PERSONAL_GITHUB_TOKEN }}
+          github-token: ${{ github.token }}
           benchmark-data-dir-path: bundle-sizes
           auto-push: true
           alert-threshold: '105%'

.github/workflows/js.yml

@@ -18,17 +18,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x
           cache: 'npm'
-      - run: npx syncpack lint
+      - run: npm ci
+      - run: npm exec -- syncpack lint
 
   verify-deps:
     name: Verify Package Dependencies
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x
@@ -40,26 +45,25 @@ jobs:
     name: Oxfmt
     runs-on: ubuntu-latest
     needs: [syncpack, verify-deps]
-    env:
-      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-      TURBO_TEAM: rocicorp
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x
           cache: 'npm'
-      - run: npx oxfmt@^0.45.0 --check
+      - run: npm ci
+      - run: npm run check-format
 
   lint:
     name: Lint
     runs-on: ubuntu-latest
     needs: [syncpack, verify-deps]
-    env:
-      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-      TURBO_TEAM: rocicorp
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x
@@ -71,11 +75,10 @@ jobs:
     name: Check Types
     runs-on: ubuntu-latest
     needs: [syncpack, verify-deps]
-    env:
-      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-      TURBO_TEAM: rocicorp
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x
@@ -91,13 +94,11 @@ jobs:
       fail-fast: false
       matrix:
         shard: [1, 2, 3]
-    env:
-      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-      TURBO_TEAM: rocicorp
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 100
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x
@@ -116,21 +117,15 @@ jobs:
       matrix:
         pg-version: [18, 17, 16, 15]
         shard: [1, 2]
-    env:
-      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-      TURBO_TEAM: rocicorp
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 100
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x
           cache: 'npm'
       - run: npm ci
       - name: Run tests
-        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4
-        with:
-          timeout_minutes: 10
-          max_attempts: 3
-          command: TEST_PG_MODE=pg-${{ matrix.pg-version }} npm run test -- --shard=${{ matrix.shard }}/2
+        run: TEST_PG_MODE=pg-${{ matrix.pg-version }} npm run test -- --shard=${{ matrix.shard }}/2

.github/workflows/mirror.yml

@@ -4,22 +4,32 @@ on:
     branches:
       - 'main'
 
+permissions:
+  contents: read
+
 jobs:
   mirror_job:
     runs-on: ubuntu-latest
     name: Mirror main branch to sandbox and terabugs branch
     steps:
-      - name: Mirror main to sandbox
-        id: mirror-sandbox
-        uses: google/mirror-branch-action@30c52ee21f5d3bd7fb28b95501c11aae7f17eebb # v2.0
-        with:
-          github-token: ${{ secrets.PERSONAL_GITHUB_TOKEN }}
-          source: 'main'
-          dest: 'sandbox'
-      - name: Mirror main to terabugs
-        id: mirror-terabugs
-        uses: google/mirror-branch-action@30c52ee21f5d3bd7fb28b95501c11aae7f17eebb # v2.0
+      - name: Create GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          github-token: ${{ secrets.PERSONAL_GITHUB_TOKEN }}
-          source: 'main'
-          dest: 'terabugs'
+          client-id: ${{ vars.ROCICORP_MIRROR_APP_CLIENT_ID }}
+          private-key: ${{ secrets.ROCICORP_MIRROR_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: mono
+          permission-contents: write
+
+      - name: Mirror main
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          for branch in sandbox terabugs; do
+            gh api \
+              --method PATCH \
+              "/repos/$GITHUB_REPOSITORY/git/refs/heads/$branch" \
+              -f "sha=$GITHUB_SHA" \
+              -F force=true
+          done