Harden GitHub Actions workflows for security

.github/CODEOWNERS

@@ -0,0 +1,5 @@
+# CODEOWNERS - Define code ownership for review requirements
+# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+# Default owners for everything in the repo
+* @CrowdStrike/chef-falcon-cs-maintainers

.github/workflows/ci.yml

@@ -1,14 +1,16 @@
 name: "Integration Tests"
+
 on:
   push:
+    branches:
+      - main
     paths:
       - 'libraries/**'
       - 'resources/**'
       - 'test/**'
       - 'ohai/**'
       - '.github/workflows/ci.yml'
-  pull_request_target:
-    types: [labeled]
+  pull_request:
     paths:
       - 'libraries/**'
       - 'resources/**'
@@ -33,14 +35,25 @@ on:
         description: 'Falcon API Version'
         required: true
 
+# Workflow-level permissions - restrict to read-only by default
+permissions: read-all
+
 jobs:
   integration:
+    # Only run on push to main, schedule, or workflow_call
+    # PRs will trigger but secrets won't be available for fork PRs
     if: |
       github.event_name == 'push' ||
       github.event_name == 'schedule' ||
-      (github.event_name == 'pull_request_target' &&
-      github.event.label.name == 'ok-to-test')
+      github.event_name == 'workflow_call' ||
+      (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ubuntu-20.04
+    timeout-minutes: 60
+    # Use environment protection for secrets access
+    environment: falcon-integration-testing
+    # Job-level permissions - least privilege
+    permissions:
+      contents: read
     strategy:
       matrix:
         os:
@@ -66,20 +79,18 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
-        if: github.event_name != 'pull_request_target'
-
-      - name: Check out code
-        uses: actions/checkout@v3
-        with:
-          ref: ${{github.event.pull_request.head.sha}}
-        if: github.event_name == 'pull_request_target'
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
 
       - name: Install Chef
-        uses: actionshub/chef-install@main
+        uses: actionshub/chef-install@776a917c09d87c381d1d5342f83cd554223fa49c  # v3.0.1
+
+      - name: Verify Chef installation
+        run: |
+          chef --version
+          chef exec ruby --version
 
       - name: Run role tests
-        uses: nick-fields/retry@v2
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08  # v3.0.2
         env:
           CHEF_LICENSE: accept-no-persist
           KITCHEN_LOCAL_YAML: kitchen.yml
@@ -97,7 +108,10 @@ jobs:
 
       - name: Print debug output on failure
         if: failure()
+        env:
+          KITCHEN_LOCAL_YAML: kitchen.yml
+          TEST_INSTANCE: ${{ matrix.suite }}-${{ matrix.os }}
         run: |
-            set -x
-            sudo journalctl -l --since today
-            KITCHEN_LOCAL_YAML=kitchen.yml /usr/bin/kitchen exec ${{ matrix.suite }}-${{ matrix.os }} -c "journalctl -l"
+          set -x
+          sudo journalctl -l --since today
+          /usr/bin/kitchen exec "${TEST_INSTANCE}" -c "journalctl -l"

.github/workflows/lint.yml

@@ -2,15 +2,21 @@ name: "Lint Tests"
 
 on:
   push:
+    branches:
+      - main
   workflow_call:
   pull_request:
 
+# Workflow-level permissions - restrict to read-only by default
+permissions: read-all
+
 jobs:
   lint-unit:
-    uses: sous-chefs/.github/.github/workflows/lint-unit.yml@2.0.1
+    # Pin to commit SHA for security
+    uses: sous-chefs/.github/.github/workflows/lint-unit.yml@1bd0cd79d49e32c55efd9227776ad90afcb2d89b  # 2.0.1
+    # Permissions required by the reusable workflow for status checks
+    # These are the minimum permissions needed for the sous-chefs lint workflow
     permissions:
-      actions: write
+      contents: read
       checks: write
-      pull-requests: write
       statuses: write
-      issues: write

.github/workflows/nightly.yml

@@ -5,17 +5,24 @@ on:
     - cron: '0 0 * * *'
   workflow_dispatch:
 
+# Workflow-level permissions - restrict to read-only by default
+permissions: read-all
+
 jobs:
   lint-unit:
     name: "Run Chef lint tests"
     uses: ./.github/workflows/lint.yml
+    # Permissions inherited from called workflow
+    permissions:
+      contents: read
+      checks: write
+      statuses: write
 
   integration:
     name: "Run Chef integration tests"
     uses: ./.github/workflows/ci.yml
-    secrets:
-      FALCON_CLIENT_ID: ${{ secrets.FALCON_CLIENT_ID }}
-      FALCON_CLIENT_SECRET: ${{ secrets.FALCON_CLIENT_SECRET }}
-      FALCON_CID: ${{ secrets.FALCON_CID }}
-      FALCON_CLOUD: ${{ secrets.FALCON_CLOUD }}
-      FALCON_VERSION: ${{ secrets.FALCON_VERSION }}
+    # Permissions inherited from called workflow
+    permissions:
+      contents: read
+    # Inherit secrets - ci.yml's environment protection provides the approval gate
+    secrets: inherit

.gitignore

@@ -24,3 +24,13 @@ Policyfile.lock.json
 .idea/
 
 .kitchen.local.yml
+
+# AI Assistant Files #
+######################
+CLAUDE.md
+.claude/
+.cursorrules
+.cursor/
+.aider*
+.copilot/
+.github/copilot-*

chefignore

@@ -113,3 +113,13 @@ UPGRADING*
 ###########
 .vagrant
 Vagrantfile
+
+# AI Assistant Files #
+######################
+CLAUDE.md
+.claude/*
+.cursorrules
+.cursor/*
+.aider*
+.copilot/*
+.github/copilot-*