ci: Harden workflows (#450)

* CI: Hardening

* Bump h2 to fix rustsec advisory

* CI: Remove cosign v2 pin

* CI: Add fork guard for manifest list

* CI: Migrate to Prek and move jobs to precommit

Author: Saul-STFC

.github/workflows/general_daily_security.yml

@@ -1,5 +1,6 @@
 ---
 name: Security audit
+permissions: {}
 
 on:
   schedule:
@@ -8,9 +9,16 @@ on:
 
 jobs:
   audit:
+    name: Audit
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      checks: write # rustsec/audit-check reports findings as a check run
+      issues: write # rustsec/audit-check opens/updates issues for new advisories
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
-      - uses: actions-rs/audit-check@35b7b53b1e25b55642157ac01b4adceb5b9ebef3 # renovate: tag=v1.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/pr_cockpit.yml

@@ -1,24 +1,27 @@
 ---
-name: pre-commit
+name: prek
 
 on:
   pull_request:
   merge_group:
 
+permissions: {}
+
 env:
   CARGO_TERM_COLOR: always
   RUST_TOOLCHAIN_VERSION: "nightly-2025-05-26"
   HADOLINT_VERSION: "v1.17.6"
   NIX_VERSION: "2.25.2"
 
 jobs:
-  pre-commit:
+  prek:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           fetch-depth: 0
-      - uses: stackabletech/actions/run-pre-commit@5901c3b1455488820c4be367531e07c3c3e82538 # v0.4.0
+      - uses: stackabletech/actions/run-prek@0fe048f952bee522474903a925ea48dc706a0bb4 # v0.17.5
         with:
           rust: ${{ env.RUST_TOOLCHAIN_VERSION }}
           hadolint: ${{ env.HADOLINT_VERSION }}