Add CodeQL scanning and harden Actions workflows

.github/workflows/ci.yml

@@ -7,6 +7,9 @@ on:
   schedule:
     - cron: 0 0 * * *
 
+permissions:  # least privilege; jobs needing OIDC override this
+  contents: read
+
 jobs:
   UnitTests:
     strategy:

.github/workflows/codeql.yml

@@ -0,0 +1,51 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: 0 0 * * 1
+  workflow_dispatch:  # allow on-demand manual scans
+
+permissions:  # least privilege
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write  # required to upload CodeQL results
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            build-mode: none
+          - language: csharp
+            build-mode: none
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Setup .NET 8
+        if: matrix.language == 'csharp'
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: '8.x'
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/documentation.yml

@@ -8,6 +8,9 @@ on:
     types: [created]
   workflow_dispatch:
 
+permissions:  # least privilege; jobs override this as needed
+  contents: read
+
 jobs:
   prepare:
     runs-on: ubuntu-latest

.github/workflows/nuget_upload.yml

@@ -5,6 +5,9 @@ on:
   release:
     types: [created]
 
+permissions:  # least privilege; the deploy job overrides this for OIDC
+  contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
@@ -25,16 +28,22 @@ jobs:
             NUGET_TOKEN,nuget-api-token-dropbox-sdk-dotnet
           parse-json-secrets: false
       - name: Pack
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: |
+          version=$(echo "$RELEASE_TAG" | cut -c 2-)
           dotnet pack \
           dropbox-sdk-dotnet/Dropbox.Api \
           -p:Configuration=Release \
-          -p:Version=$(echo "${{ github.event.release.tag_name }}" | cut -c 2-) \
+          -p:Version="$version" \
           -p:AssemblyOriginatorKeyFile=dropbox_api_key.snk \
           -p:SignAssembly=true
       - name: Push
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: |
+          version=$(echo "$RELEASE_TAG" | cut -c 2-)
           dotnet nuget push \
-          dropbox-sdk-dotnet/Dropbox.Api/bin/Release/Dropbox.Api.$(echo "${{ github.event.release.tag_name }}" | cut -c 2-).nupkg \
+          "dropbox-sdk-dotnet/Dropbox.Api/bin/Release/Dropbox.Api.$version.nupkg" \
           --source https://api.nuget.org/v3/index.json \
-          --api-key ${{ env.NUGET_TOKEN }}
+          --api-key "$NUGET_TOKEN"

.github/workflows/spec_update.yml

@@ -4,6 +4,9 @@ on:
   repository_dispatch:
     types: [spec_update]
 
+permissions:  # least privilege; the Update job overrides this for OIDC
+  contents: read
+
 jobs:
   Update:
     runs-on: ubuntu-latest
@@ -43,25 +46,29 @@ jobs:
           git submodule update --remote --recursive
       - name: Generate Branch Name
         id: git-branch
+        env:
+          FORMATTED_TIME: ${{ steps.current-time.outputs.formattedTime }}
         run: |
-          echo "::set-output name=branch::spec_update_${{ steps.current-time.outputs.formattedTime }}"
+          echo "branch=spec_update_${FORMATTED_TIME}" >> "$GITHUB_OUTPUT"
       - name: Generate Num Diffs
         id: git-diff-num
         run: |
           diffs=$(git diff --submodule spec | grep ">" | wc -l)
           echo "Number of Spec diffs: $diffs"
-          echo "::set-output name=num-diff::$diffs"
+          echo "num-diff=$diffs" >> "$GITHUB_OUTPUT"
       - name: Generate Diff
         id: git-diff
+        env:
+          NUM_DIFF: ${{ steps.git-diff-num.outputs.num-diff }}
         run: |
           cd spec
-          gitdiff=$(git log -n ${{ steps.git-diff-num.outputs.num-diff }} --pretty="format:%n %H %n%n %b")
+          gitdiff=$(git log -n "$NUM_DIFF" --pretty="format:%n %H %n%n %b")
           commit="Automated Spec Update $gitdiff"
-          commit="${commit//'%'/'%25'}"
-          commit="${commit//$'\n'/'%0A'}"
-          commit="${commit//$'\r'/'%0D'}"
-          echo "Commit Message: $commit"
-          echo "::set-output name=commit::$commit"
+          {
+            echo "commit<<SPEC_UPDATE_EOF"
+            echo "$commit"
+            echo "SPEC_UPDATE_EOF"
+          } >> "$GITHUB_OUTPUT"
       - name: Generate New Routes
         run: |
           python generator/generate_routes.py