[CI/Supply chain] Reuse generated artifacts, minimize permissions, and pin Actions

[rwang23]

[CI/Supply chain] Reuse generated artifacts, minimize permissions, and pin Actions

Draft status: ready to create; not submitted by the audit run.
Priority: P1
Findings: ACT-025, ACT-031

Summary

The workflows provide useful cross-platform coverage, but expensive generation is repeated, the full desktop matrix receives contents: write, Actions use mutable version tags, and the Pages screenshot check only proves that a non-empty PNG file was produced.

中文摘要：CI 已有多平台基础，但同一输入被重复生成，桌面矩阵权限过宽，Action 未固定 commit，Pages 截图只检查文件非空。需要生成一次复用、最小权限、供应链检查与真正的页面断言。

Audit evidence

• Desktop validate generates/validates/tests once.
• Each desktop matrix entry generates/validates/prepares again.
• Pages generates again separately.
• The entire desktop matrix job has contents: write, including ordinary validation/PR contexts.
• actions/checkout@v7, actions/setup-node@v7, swatinem/rust-cache@v2, and tauri-apps/tauri-action@v1 are referenced by mutable tags rather than commit SHA.
• No CodeQL, Dependabot, actionlint/zizmor, cargo-audit/deny, SBOM, or release provenance workflow was found.
• Pages browser smoke takes a screenshot and checks only test -s gallery-home.png; Registry errors, 404s, console errors, stale counts, or inaccessible interactions can still pass.

Proposed direction

• Generate and validate canonical artifacts once in a read-only Linux job; upload a checksummed artifact for all downstream consumers.
• Default all jobs to contents: read; isolate release upload/signing in a protected tag-only job.
• Pin all Actions to full commit SHA with a comment showing the human-readable version.
• Add dependency/workflow scanning and release SBOM/provenance.
• Replace the non-empty screenshot smoke with Playwright assertions for console/network/card count/keyboard/axe/performance budget.

Acceptance criteria

• One canonical generated artifact is reused by desktop OS matrices and Pages for the same commit.
• PR and validation jobs have no write permission and cannot access release-signing secrets.
• Only a protected release job receives contents: write and signing/update credentials.
• All third-party and official Actions are pinned to immutable SHAs and automatically maintained through reviewed update PRs.
• Workflow lint/security scanning runs in PRs.
• Release artifacts include checksums, SBOM, build commit, platform/architecture, and provenance/attestation.
• Pages tests fail on console/page errors, 404s, wrong card/theme counts, missing Registry content, keyboard failure, axe serious/critical issues, or agreed media/performance budget regressions.
• Stale workflow runs can be canceled safely where deployment ordering permits.

Related audit findings

ACT-025, ACT-031.

A workflow design reference is available in demo/ci/desktop-optimized.yml in the audit bundle.

[rwang23]

The artifact reuse, least-privilege, immutable Action pins, and PR workflow checks landed in #26 and pass the current repository/CI contract checks.

Release SBOM generation and release provenance/attestation are not yet present as produced release artifacts. Keeping this Issue open for that remaining supply-chain gate.