Bind workflow expressions and drop persisted credentials

.github/workflows/image-build-and-publish.yml

@@ -18,6 +18,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
@@ -48,7 +50,7 @@ jobs:
           BUILD_DATE: ${{ github.event.head_commit.timestamp }}
           KO_CONFIG_PATH: ${{ github.workspace }}/.github/ko-ci.yml
         run: |
-          TAG=${{ steps.version-string.outputs.tag }}
+          TAG="$VERSION"
           TAGS="-t $TAG"
 
           # Add latest tag only if building from a tag
@@ -62,8 +64,10 @@ jobs:
       - name: Sign Image with Cosign
         # This step uses the identity token to provision an ephemeral certificate
         # against the sigstore community Fulcio instance.
+        env:
+          VERSION: ${{ steps.version-string.outputs.tag }}
         run: |
-          TAG=${{ steps.version-string.outputs.tag }}
+          TAG="$VERSION"
           # Sign the ko image
           cosign sign -y $BASE_REPO:$TAG
 
@@ -86,6 +90,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
 
       - name: Compute version number
         id: version-string
@@ -129,8 +135,10 @@ jobs:
 
       - name: Sign container image
         if: startsWith(github.ref, 'refs/tags/')
+        env:
+          VERSION: ${{ steps.version-string.outputs.tag }}
         run: |
-          TAG=${{ steps.version-string.outputs.tag }}
+          TAG="$VERSION"
           cosign sign -y $BASE_REPO:$TAG
           cosign sign -y $BASE_REPO:latest
 
@@ -148,6 +156,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
@@ -190,7 +200,7 @@ jobs:
           BUILD_DATE: ${{ github.event.head_commit.timestamp }}
           KO_CONFIG_PATH: ${{ github.workspace }}/.github/ko-ci.yml
         run: |
-          TAG=${{ steps.version-string.outputs.tag }}
+          TAG="$VERSION"
           TAGS="-t $TAG"
 
           # Add latest tag only if building from a tag
@@ -204,8 +214,10 @@ jobs:
       - name: Sign Image with Cosign
         # This step uses the identity token to provision an ephemeral certificate
         # against the sigstore community Fulcio instance.
+        env:
+          VERSION: ${{ steps.version-string.outputs.tag }}
         run: |
-          TAG=${{ steps.version-string.outputs.tag }}
+          TAG="$VERSION"
           # Sign the ko image
           cosign sign -y $BASE_REPO:$TAG
 
@@ -228,6 +240,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
@@ -261,7 +275,7 @@ jobs:
           BUILD_DATE: ${{ github.event.head_commit.timestamp }}
           KO_CONFIG_PATH: ${{ github.workspace }}/.github/ko-ci.yml
         run: |
-          TAG=${{ steps.version-string.outputs.tag }}
+          TAG="$VERSION"
           TAGS="-t $TAG"
           # Add latest tag only if building from a tag
           if [[ "$GITHUB_REF" == refs/tags/* ]]; then
@@ -273,8 +287,10 @@ jobs:
       - name: Sign Image with Cosign
         # This step uses the identity token to provision an ephemeral certificate
         # against the sigstore community Fulcio instance.
+        env:
+          VERSION: ${{ steps.version-string.outputs.tag }}
         run: |
-          TAG=${{ steps.version-string.outputs.tag }}
+          TAG="$VERSION"
           # Sign the ko image
           cosign sign -y $BASE_REPO:$TAG
 
@@ -297,6 +313,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
@@ -339,7 +357,7 @@ jobs:
           BUILD_DATE: ${{ github.event.head_commit.timestamp }}
           KO_CONFIG_PATH: ${{ github.workspace }}/.github/ko-ci.yml
         run: |
-          TAG=$(echo "${{ steps.version-string.outputs.tag }}" | sed 's/+/_/g')
+          TAG=$(echo "$VERSION" | sed 's/+/_/g')
           TAGS="-t $TAG"
 
           # Add latest tag only if building from a tag
@@ -353,8 +371,10 @@ jobs:
       - name: Sign Image with Cosign
         # This step uses the identity token to provision an ephemeral certificate
         # against the sigstore community Fulcio instance.
+        env:
+          VERSION: ${{ steps.version-string.outputs.tag }}
         run: |
-          TAG=$(echo "${{ steps.version-string.outputs.tag }}" | sed 's/+/_/g')
+          TAG=$(echo "$VERSION" | sed 's/+/_/g')
           # Sign the ko image
           cosign sign -y $BASE_REPO:$TAG
 

.github/workflows/issue-triage.yml

@@ -17,6 +17,7 @@ jobs:
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Run Claude Code for Issue Triage
         uses: anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b # v1.0.183

.github/workflows/release-notes.yml

@@ -67,6 +67,7 @@ jobs:
           # Full history + tags are required: the skill lists/sorts tags and
           # compares ranges between the current and previous release.
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Resolve release tag
         id: tag
@@ -137,8 +138,10 @@ jobs:
 
       - name: Verify notes were generated
         id: verify
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
         run: |
-          FILE="release-notes-${{ steps.tag.outputs.tag }}.md"
+          FILE="release-notes-${TAG}.md"
           if [ ! -s "$FILE" ]; then
             echo "::error::Expected $FILE was not generated by the release-notes skill"
             exit 1
@@ -170,19 +173,22 @@ jobs:
           if-no-files-found: error
 
       - name: Write notes to job summary
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+          FILE: ${{ steps.verify.outputs.file }}
         run: |
           {
-            echo "## 📝 Generated release notes for \`${{ steps.tag.outputs.tag }}\`"
+            echo "## 📝 Generated release notes for \`${TAG}\`"
             echo ""
             echo "Review below, then copy-paste into the release or run:"
             echo ""
             echo '```'
-            echo "gh release edit ${{ steps.tag.outputs.tag }} --notes-file ${{ steps.verify.outputs.file }}"
+            echo "gh release edit ${TAG} --notes-file ${FILE}"
             echo '```'
             echo ""
             echo "---"
             echo ""
-            cat "${{ steps.verify.outputs.file }}"
+            cat "${FILE}"
           } >> "$GITHUB_STEP_SUMMARY"
 
       - name: Post notes as a comment on the release PR

.github/workflows/security-scan.yml

@@ -13,14 +13,18 @@ on:
     # Run daily at 2 AM UTC
     - cron: '0 2 * * *'
 
+# security-events: write is granted per job rather than here, so only the two
+# jobs that upload SARIF can write security events.
 permissions:
   contents: read
-  security-events: write
 
 jobs:
   grype-repo-scan:
     name: Grype Repository Scan
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
@@ -45,6 +49,9 @@ jobs:
   zizmor:
     name: GitHub Actions Static Analysis
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
     # --no-exit-codes stops *findings* failing the job; this stops a tool or
     # network failure doing so. Both come off when the gate goes blocking.
     continue-on-error: true

.github/workflows/skills-build-and-publish.yml

@@ -43,6 +43,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6

.github/workflows/test-e2e-lifecycle.yml

@@ -102,7 +102,7 @@ jobs:
 
         # Pull and load all test server images in parallel to speed up CI
         echo "Pulling and loading test server images..."
-        docker pull ${{ env.YARDSTICK_IMAGE }} &
+        docker pull "$YARDSTICK_IMAGE" &
         docker pull ghcr.io/stackloklabs/gofetch/server:1.0.1 &
         docker pull ghcr.io/stackloklabs/osv-mcp/server:0.0.7 &
         docker pull python:3.9-slim &
@@ -112,7 +112,7 @@ jobs:
         wait
 
         # Load all images into kind
-        kind load docker-image --name toolhive ${{ env.YARDSTICK_IMAGE }}
+        kind load docker-image --name toolhive "$YARDSTICK_IMAGE"
         kind load docker-image --name toolhive ghcr.io/stackloklabs/gofetch/server:1.0.1
         kind load docker-image --name toolhive ghcr.io/stackloklabs/osv-mcp/server:0.0.7
         kind load docker-image --name toolhive python:3.9-slim
@@ -123,7 +123,7 @@ jobs:
     - name: Deploy operator with VMCP_IMAGE
       run: |
         export KUBECONFIG=kconfig.yaml
-        echo "Deploying operator with vmcp image: ${{ env.VMCP_IMAGE }}"
+        echo "Deploying operator with vmcp image: ${VMCP_IMAGE}"
 
         # Build operator and proxyrunner images
         OPERATOR_IMAGE=$(KO_DOCKER_REPO=kind.local ko build --local -B ./cmd/thv-operator | tail -n 1)
@@ -137,7 +137,7 @@ jobs:
         helm upgrade --install toolhive-operator deploy/charts/operator \
           --set operator.image=${OPERATOR_IMAGE} \
           --set operator.toolhiveRunnerImage=${TOOLHIVE_IMAGE} \
-          --set operator.vmcpImage=${{ env.VMCP_IMAGE }} \
+          --set operator.vmcpImage=${VMCP_IMAGE} \
           --namespace toolhive-system \
           --create-namespace \
           --kubeconfig kconfig.yaml