ci: harden CI pipeline for external/fork PRs (GTI-846)

[sagile]

Summary

• permissions: contents: read on build.yml — explicit least-privilege for fork PR runs; no secrets are accessible to untrusted code
• Concurrency groups on build.yml, early-access.yml, and release.yml — superseded runs are cancelled automatically (cancel-in-progress: false on release to avoid mid-publish interruption)
• SHA-pinned all third-party actions — replaces mutable @v4 / @v2 tags with immutable commit SHAs across all four workflows; a compromised tag can no longer silently swap action code
• Removed styfle/cancel-workflow-action in early-access.yml and release.yml — replaced with native concurrency blocks; eliminates an extra third-party dependency and the PAT it required
• jreleaser/release-action pinned to 2.5.0 tag SHA (90ac653) instead of the mutable v2 branch ref

Acceptance criteria (GTI-846)

• Fork PRs build & test safely with no secret access
• Workflow permissions are least-privilege
• All third-party actions are SHA-pinned
• Concurrency groups cancel superseded runs

Manual step required (cannot be done via YAML)

Enable Settings → Actions → General → Fork pull request workflows → "Require approval for first-time contributors" to gate workflow runs from first-time external contributors behind maintainer approval.

🤖 Generated with Claude Code

---

Note

Medium Risk
PR validation scope changed from full build to explicit Gradle targets, so coverage gaps are possible if modules were previously picked up only by the monolithic task.

Overview
Hardens GitHub Actions for fork/untrusted PRs and supply-chain risk: build.yml now declares least-privilege permissions (contents: read, actions: write for artifacts), concurrency that cancels superseded PR runs, and commit-SHA–pinned third-party actions instead of mutable @v4/@v2 tags.

The PR build is no longer one ./gradlew build job—it’s split into style (Spotless), compile (assemble), test (after compile: :core:test plus demo VCR modules), and spotbugs in parallel after compile; failed-test artifact paths point at those module report dirs.

early-access.yml and release.yml drop styfle/cancel-workflow-action (and its PAT) in favor of native concurrency; release keeps cancel-in-progress: false so publishes aren’t interrupted. docs.yml (and release/early-access) get the same SHA pinning; JReleaser is pinned to the 2.5.0 action SHA.

Maintainers still need the repo setting to require approval for first-time contributors on fork workflows—that’s called out as outside YAML.

^{Reviewed by Cursor Bugbot for commit e0b57ae. Bugbot is set up for automated code reviews on this repo. Configure here.}

[jit-ci]

🛡️ Jit Security Scan Results

✅ No security findings were detected in this PR

---

^{Security scan by Jit}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7fc85a4. Configure here.}