Reducing security risk in our GitHub workflows

[afshin]

We have switched the default behavior for this org to "Workflows have read permissions in the repository for the contents scope only" to utilize GitHub Actions: Control permissions for GITHUB_TOKEN . See also jupyterhub/team-compass#404

An example PR that allows fine-grained permissions is jupyterlab/jupyterlab#10136.

[krassowski]

As a precaution for JupyterLab Desktop, can we harden its publish action? CC @mbektas:

• could we use conda-incubator/setup-miniconda over s-weigand/setup-conda (more eyes on the former one)
• could we hash-pin svenstaro/upload-release-action?
• could we hash-pin codex-team/action-nodejs-package-info?

Or maybe some of these are not needed in the first place.

[krassowski]

At jupyterlab-translate, we may want to hash-pin ncipollo/release-action (again, few watchers).

[mbektas]

As a precaution for JupyterLab Desktop, can we harden its publish action? CC @mbektas:

• could we use conda-incubator/setup-miniconda over s-weigand/setup-conda (more eyes on the former one)
• could we hash-pin svenstaro/upload-release-action?
• could we hash-pin codex-team/action-nodejs-package-info?

Or maybe some of these are not needed in the first place.

I think these changes make sense for precaution.

[goanpeca]

@conda-incubator/setup-miniconda maintainer creator here 😶 ... no pressure 😆