fix(security): least-privilege workflows, pinned actions, webview dependency updates

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -38,16 +38,15 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
-  contents: write
+  contents: read
   pull-requests: read
-  checks: write
 
 jobs:
   boundary-gates:
     name: Boundary gates
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Run all scripts/check-*.sh (excluding app-builds)
         run: |
           fail=0
@@ -73,13 +72,13 @@ jobs:
     name: Webview (pnpm test + build)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           version: 10.30.2
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "20"
           cache: "pnpm"
@@ -108,7 +107,7 @@ jobs:
       # Artifact is the production-stamped App/Resources/webview/ tree.
       # Downstream SPM + app-build jobs depend on this artifact name.
       - name: Upload App/Resources/webview artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: webview-resources
           path: App/Resources/webview/
@@ -182,7 +181,7 @@ jobs:
             | xargs -r -I{} kill -9 {} 2>/dev/null || true
           echo "Surviving xctest/swift-test processes (any age — includes concurrent CI work on sibling runners):"
           /bin/ps -A -o pid,etime,comm | grep -E '(xctest|swift-test|swift-driver)$' || echo "  (none)"
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       # Project targets macOS 26 Tahoe + Swift 6.2/6.3. Xcode 16 (Swift 6.0)
       # cannot parse `mlx-audio-swift` v0.1.2's `swift-tools-version:6.2`,
       # lacks the `withThrowingTaskGroup` overload used by MCP `swift-sdk`
@@ -217,7 +216,7 @@ jobs:
       # not mounted` because index.html + the JS bundle are missing from
       # App/Resources/webview/.
       - name: Download webview resources
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: webview-resources
           path: App/Resources/webview/
@@ -231,7 +230,7 @@ jobs:
       # the cache action to github-hosted only.
       - name: Cache SPM build artifacts (github-hosted only)
         if: runner.environment == 'github-hosted'
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             packages/${{ matrix.package }}/.build
@@ -279,7 +278,7 @@ jobs:
     runs-on: macos-15
     needs: [boundary-gates, webview]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       # Same Xcode 26.x pin as swift-packages — Xcode 16 cannot resolve
       # mlx-audio-swift's swift-tools-version:6.2 manifest.
       - name: Select Xcode
@@ -293,11 +292,11 @@ jobs:
       # and re-stamps the bundle — and would error with
       # "[build-webview] FATAL: pnpm not found on PATH" without these.
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           version: 10.30.2
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "20"
           cache: "pnpm"
@@ -305,7 +304,7 @@ jobs:
       # Reuse the webview build from the upstream job rather than rebuilding.
       # The Xcode build phase will re-stamp these on top.
       - name: Download webview resources
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: webview-resources
           path: App/Resources/webview/
@@ -314,7 +313,7 @@ jobs:
       - name: verify-codesign-settings.sh
         run: bash scripts/verify-codesign-settings.sh
       - name: Upload Jarvis.app artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: Jarvis-app-debug
           path: build/Build/Products/Debug/Jarvis.app
@@ -327,7 +326,7 @@ jobs:
     if: github.event_name == 'workflow_dispatch' && github.event.inputs.run_real_hardware == 'true'
     needs: [swift-packages]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: JARVIS_REAL_MODELS Memory regression corpus
         env:
           JARVIS_REAL_MODELS: "1"
@@ -342,6 +341,8 @@ jobs:
         run: swift test --package-path packages/Voice --filter OrpheusTTFATests
 
   publish-tag:
+    permissions:
+      contents: write
     name: Publish tag
     runs-on: ubuntu-latest
     needs: [boundary-gates, webview, swift-packages, app-build]
@@ -353,7 +354,7 @@ jobs:
         startsWith(github.ref, 'refs/heads/release/')
       )
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
       - name: Compute next version

.github/workflows/dependency-review.yml

@@ -17,16 +17,18 @@ on:
 
 permissions:
   contents: read
-  pull-requests: write
 
 jobs:
   dependency-review:
+    permissions:
+      contents: read
+      pull-requests: write
     name: Dependency Review
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Dependency Review
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4
         with:
           fail-on-severity: high
           # Default license policy: warn on copyleft, fail on nothing automatically.

.github/workflows/release.yml

@@ -13,14 +13,16 @@ on:
       - "v[0-9]+.[0-9]+.[0-9]+-*"
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   release:
+    permissions:
+      contents: write
     name: Publish GitHub Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
@@ -70,7 +72,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           tag_name: ${{ github.ref_name }}
           name: ${{ github.ref_name }}

.github/workflows/scorecard.yml

@@ -41,12 +41,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           persist-credentials: false
 
       - name: Run Scorecard
-        uses: ossf/scorecard-action@v2.4.0
+        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
         with:
           results_file: results.sarif
           results_format: sarif
@@ -57,6 +57,6 @@ jobs:
           publish_results: true
 
       - name: Upload SARIF to code-scanning
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@ce5e7eeac396d720fe2d802714996c8ce561e311 # v3
         with:
           sarif_file: results.sarif

.github/workflows/semgrep.yml

@@ -20,17 +20,19 @@ concurrency:
 
 permissions:
   contents: read
-  security-events: write
 
 jobs:
   semgrep:
+    permissions:
+      contents: read
+      security-events: write
     name: Semgrep scan
     runs-on: ubuntu-latest
     container:
       image: semgrep/semgrep
     if: (github.actor != 'dependabot[bot]')
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Semgrep CI
         env:
@@ -47,7 +49,7 @@ jobs:
 
       - name: Upload SARIF (when present)
         if: hashFiles('semgrep.sarif') != ''
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@ce5e7eeac396d720fe2d802714996c8ce561e311 # v3
         with:
           sarif_file: semgrep.sarif
           category: semgrep

webview/package.json

@@ -3,7 +3,9 @@
   "private": true,
   "version": "0.0.0",
   "packageManager": "pnpm@10.30.2",
-  "engines": { "node": ">=20.0.0" },
+  "engines": {
+    "node": ">=20.0.0"
+  },
   "scripts": {
     "test": "pnpm -r test",
     "build": "pnpm -r build",
@@ -11,13 +13,18 @@
   },
   "devDependencies": {
     "typescript": "^5.5.0",
-    "vitest": "^3.0.0",
+    "vitest": "^4.1.11",
     "@types/node": "^20.0.0"
   },
   "pnpm": {
     "overrides": {
-      "vite": ">=8.0.12",
-      "esbuild": ">=0.25.0"
+      "vite": ">=8.0.16",
+      "esbuild": ">=0.25.0",
+      "undici": "^7.29.1",
+      "nanoid": "^3.3.12",
+      "postcss": "^8.5.23",
+      "fflate": "^0.8.3",
+      "source-map-js": "^1.2.2"
     }
   }
 }

webview/packages/bus/package.json

@@ -19,6 +19,6 @@
   },
   "devDependencies": {
     "typescript": "^5.5.0",
-    "vitest": "^3.0.0"
+    "vitest": "^4.1.11"
   }
 }

webview/packages/hud/package.json

@@ -25,7 +25,7 @@
     "@vitejs/plugin-react": "^6.0.1",
     "typescript": "^5.9.0",
     "vite": "^8.0.0",
-    "vitest": "^3.0.0",
+    "vitest": "^4.1.11",
     "@testing-library/react": "^16.3.0",
     "@testing-library/jest-dom": "^6.6.0",
     "jsdom": "^29.1.1"