GHA security

.github/workflows/android.yml

@@ -1,4 +1,4 @@
-# Copyright 2021-2025, Collabora, Ltd.
+# Copyright 2021-2026, Collabora, Ltd.
 # SPDX-License-Identifier: CC0-1.0
 
 name: Android
@@ -18,14 +18,20 @@ on:
         description: "Should we make a debug configured build?"
         default: true
 
+permissions: {}
+
 jobs:
   # Loader
   loader:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Get modern CMake and Ninja
-        uses: "lukka/get-cmake@v4.2.3"
+        uses: "lukka/get-cmake@f176ccd3f28bda569c43aae4894f06b2435a3375" # lukka/get-cmake@v4.2.3
 
       # Do this before building aar since it affects the version
       - name: Touch SNAPSHOT marker file
@@ -36,33 +42,37 @@ jobs:
         run: "./maintainer-scripts/build-aar.sh"
 
       - name: Upload bare AAR
-        uses: "actions/upload-artifact@v7"
+        uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # actions/upload-artifact@v7
         with:
           name: AAR and POM
           path: openxr_loader_for_android*
 
   # Hello XR
   build-helloxr:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: "actions/checkout@v7"
+      - uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: "Get modern CMake and Ninja"
-        uses: "lukka/get-cmake@v4.2.3"
+        uses: "lukka/get-cmake@f176ccd3f28bda569c43aae4894f06b2435a3375" # lukka/get-cmake@v4.2.3
       - name: "set up JDK"
-        uses: "actions/setup-java@v5"
+        uses: "actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520" # actions/setup-java@v5
         with:
           java-version-file: ".github/.java-version"
           distribution: "temurin"
       # Also performs Gradle wrapper validation
-      - uses: "gradle/actions/setup-gradle@v5"
+      - uses: "gradle/actions/setup-gradle@6f229686ee4375cc4a86b2514c89bac4930e82c4" # gradle/actions/setup-gradle@v5
 
       # HelloXR OpenGLES version
       - name: Build HelloXR OpenGLES for Android
         run: "cd src/tests/hello_xr && ./gradlew assembleOpenGLES${{ inputs.release && 'Release' || 'Debug' }}"
 
       - name: Upload HelloXR OpenGLES (debug) for Android
         if: "!inputs.release"
-        uses: "actions/upload-artifact@v7"
+        uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # actions/upload-artifact@v7
         with:
           name: HelloXR OpenGLES Android
           path: "src/tests/hello_xr/build/outputs/apk/OpenGLES/debug/*.apk"

.github/workflows/check_clang_format_and_codespell.yml

@@ -6,16 +6,21 @@ name: Check code formatting and spelling
 on:
   workflow_call:
 
+permissions: {}
+
 jobs:
   clang-format:
     runs-on: ubuntu-latest
     container:
       image: khronosgroup/docker-images:openxr.20260415@sha256:800fd68bd1b16b426555158f4aa06b2ef1c150fba922d7a11361fc85f6ba0bcd
 
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # actions/checkout@v7
         with:
           lfs: true
+          persist-credentials: false
 
       - run: ./runClangFormat.sh
         name: Run clang-format
@@ -28,7 +33,7 @@ jobs:
         if: ${{ failure() }}
       - name: Publish diff
         if: ${{ failure() }}
-        uses: actions/upload-artifact@v7
+        uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # actions/upload-artifact@v7
         with:
           path: ${{ runner.temp }}/clang-format.patch
           name: clang-format-changes

.github/workflows/macOS.yml

@@ -5,30 +5,34 @@ name: macOS
 
 on:
   push:
-    branches: [ main ]
+    branches: [main]
 
   pull_request:
-    branches: [ main ]
+    branches: [main]
 
 permissions:
   contents: read
 
 jobs:
   macOS-build:
     strategy:
-        matrix:
-          device: [
+      matrix:
+        device: [
             macos-15-intel, # Tests Mac x86_64
             macos-latest, # Tests Mac arm64
           ]
     runs-on: ${{ matrix.device }}
 
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: "Get modern CMake and Ninja"
-        uses: "lukka/get-cmake@v4.2.3"
+        uses: "lukka/get-cmake@f176ccd3f28bda569c43aae4894f06b2435a3375" # lukka/get-cmake@v4.2.3
       - name: Prepare Vulkan SDK
-        uses: humbletim/setup-vulkan-sdk@v1.2.1
+        uses: "humbletim/setup-vulkan-sdk@c25f41106918cde0bf347e6f201277392b3a9e9d" # humbletim/setup-vulkan-sdk@v1.2.1
         with:
           vulkan-query-version: 1.3.290.0
           vulkan-components: Vulkan-Headers, Vulkan-Loader

.github/workflows/macos-build.yml

@@ -1,19 +1,25 @@
-# Copyright 2021-2025, Collabora, Ltd.
+# Copyright 2021-2026, Collabora, Ltd.
 # SPDX-License-Identifier: CC0-1.0
 
 name: macOS builds
 on:
   workflow_call:
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   macos-build:
     name: macOS build
     runs-on: macos-latest
 
+    permissions:
+      contents: read
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Install Dependencies
         run: |
@@ -49,7 +55,7 @@ jobs:
           tar -czvf openxr_loader_macos.tar.gz *
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v7
+        uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # actions/upload-artifact@v7
         with:
           name: openxr_loader_macos
           path: install/openxr_loader_macos.tar.gz

.github/workflows/msvc-build-preset.yml

@@ -1,6 +1,8 @@
-# Copyright 2021-2025, Collabora, Ltd.
+# Copyright 2021-2026, Collabora, Ltd.
 # SPDX-License-Identifier: CC0-1.0
 
+name: "MSVC Build Preset"
+
 on:
   workflow_call:
     inputs:
@@ -22,24 +24,29 @@ on:
         type: string
         default: install
 
+permissions: {}
+
 jobs:
   msvc-build:
+    permissions:
+      contents: read
     runs-on: windows-latest
     env:
       VULKAN_SDK_VERSION: "1.1.114.0"
       INSTALL_DIR: "${{ github.workspace }}/install"
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # actions/checkout@v7
         with:
           lfs: true
           fetch-tags: "${{ !github.event.release }}"
           fetch-depth: "${{ github.event.release && '0' || '1'}}"
+          persist-credentials: false
 
       - name: Get modern CMake and Ninja
-        uses: lukka/get-cmake@v4.2.3
+        uses: "lukka/get-cmake@f176ccd3f28bda569c43aae4894f06b2435a3375" # lukka/get-cmake@v4.2.3
 
       - name: Add msbuild to PATH
-        uses: microsoft/setup-msbuild@v3
+        uses: "microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57" # microsoft/setup-msbuild@v3
 
       - name: Install Vulkan SDK
         run: ./.github/scripts/install_vulkan.ps1
@@ -51,15 +58,22 @@ jobs:
         shell: pwsh
         run: |
           Copy-Item .github/scripts/CMakePresets.json .
-          cmake --fresh --preset ${{ inputs.preset }} -S . -B $env:RUNNER_TEMP
+          cmake --fresh --preset $env:INPUTS_PRESET -S . -B $env:RUNNER_TEMP
+        env:
+          INPUTS_PRESET: ${{ inputs.preset }}
+
       - name: Build
-        run: "cmake --build $env:RUNNER_TEMP --parallel --clean-first --config ${{ inputs.buildType }}"
+        run: "cmake --build $env:RUNNER_TEMP --parallel --clean-first --config $env:INPUTS_BUILDTYPE"
+        env:
+          INPUTS_BUILDTYPE: ${{ inputs.buildType }}
 
       - name: Install
-        run: "cmake --build $env:RUNNER_TEMP --parallel --config ${{ inputs.buildType }} --target install"
+        run: "cmake --build $env:RUNNER_TEMP --parallel --config $env:INPUTS_BUILDTYPE --target install"
+        env:
+          INPUTS_BUILDTYPE: ${{ inputs.buildType }}
 
       - name: Upload Artifacts
-        uses: actions/upload-artifact@v7
+        uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # actions/upload-artifact@v7
         if: inputs.artifactName
         with:
           name: "${{ inputs.artifactName }}"

.github/workflows/pr.yml

@@ -1,10 +1,13 @@
-# Copyright 2021-2022, Collabora, Ltd.
+# Copyright 2021-2026, Collabora, Ltd.
 # SPDX-License-Identifier: CC0-1.0
 
 name: Pull request checks
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   msvc-build:
     uses: ./.github/workflows/windows-matrix.yml

.github/workflows/release.yml

@@ -1,4 +1,4 @@
-# Copyright 2021-2025, Collabora, Ltd.
+# Copyright 2021-2026, Collabora, Ltd.
 # SPDX-License-Identifier: CC0-1.0
 
 name: Build release artifacts
@@ -7,6 +7,9 @@ on:
     types: [published]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   # Currently Android artifacts are generated and signed internally before publication to GitHub.
   # android:

.github/workflows/snapshot.yml

@@ -1,10 +1,13 @@
-# Copyright 2021, Collabora, Ltd.
+# Copyright 2021-2026, Collabora, Ltd.
 # SPDX-License-Identifier: CC0-1.0
 
 name: Android Builds - Publish Snapshot
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   android:
     uses: ./.github/workflows/android.yml

.github/workflows/windows-matrix.yml

@@ -1,4 +1,4 @@
-# Copyright 2021-2023, Collabora, Ltd.
+# Copyright 2021-2026, Collabora, Ltd.
 # SPDX-License-Identifier: CC0-1.0
 
 name: Windows builds
@@ -11,17 +11,21 @@ on:
         default: false
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   # generate_matrix:
   #   runs-on: ubuntu-latest
   #   outputs:
   #     matrix: "${{ steps.set-matrix.outputs.matrix }}"
   #   steps:
-  #     - uses: "actions/checkout@v7"
+  #     - uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # actions/checkout@v7
   #     - id: set-matrix
   #       run: "python3 .github/scripts/generate_windows_matrix_build.py matrix"
   msvc-build:
     # needs: generate_matrix
+    permissions:
+      contents: read
     strategy:
       fail-fast: true
       # TODO: Fix matrix generation? Broke recently due to changes in github actions
@@ -42,31 +46,36 @@ jobs:
       buildType: "RelWithDebInfo"
 
   organize-and-release-artifacts:
+    name: "Organize and combine Windows artifacts"
     if: inputs.organizeAndRelease
     needs:
       - msvc-build
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
     steps:
-      - uses: "actions/checkout@v7"
+      - uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Retrieve artifacts
-        uses: "actions/download-artifact@v8"
+        uses: "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" # actions/download-artifact@v8
         with:
           path: artifacts
 
       - name: Organize artifacts
         run: 'python .github/scripts/organize_windows_artifacts.py "${{ github.workspace }}" "${{ github.workspace }}/openxr_loader"'
 
       - name: Upload combined artifact
-        uses: "actions/upload-artifact@v7"
+        uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # actions/upload-artifact@v7
         with:
           name: openxr_loader_windows
           path: "${{ github.workspace }}/openxr_loader"
 
       # NuGet stuff now
 
       - name: Setup NuGet
-        uses: "NuGet/setup-nuget@12c57947e9458a5b976961b08ea0706a17dd71ae"
+        uses: "NuGet/setup-nuget@12c57947e9458a5b976961b08ea0706a17dd71ae" # NuGet/setup-nuget@v3
         with:
           nuget-version: "5.x"
 
@@ -78,7 +87,7 @@ jobs:
         run: 'nuget pack "${{ github.workspace }}/openxr_loader_staging/OpenXR.Loader.nuspec" -OutputDirectory "${{ github.workspace }}/nuget"'
 
       - name: Upload NuGet artifact
-        uses: "actions/upload-artifact@v7"
+        uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # actions/upload-artifact@v7
         with:
           name: NuGet
           path: "${{ github.workspace }}/nuget"