fix(workflow): fixing workflows

.github/workflows/commitlint.yml

@@ -8,17 +8,20 @@ on:
       dev
       testnet-goerli
 
+permissions:
+  contents: read
+
 jobs:
   commitlint:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
-      - name: Install node dependencies
-        run: |
-          npm install conventional-changelog-conventionalcommits
-          npm install [email protected]
+
+      - name: Install dependencies
+        run: npm ci
 
       - name: Validate current commit (last commit) with commitlint
         if: github.event_name == 'push'

.github/workflows/forge-test-intense.yml

@@ -8,6 +8,9 @@ on:
       - testnet-holesky
       - dev
 
+permissions:
+  contents: read
+
 env:
   FOUNDRY_PROFILE: intense
 
@@ -19,15 +22,16 @@ jobs:
   forge-test-intense:
     name: Test (Intense)
     runs-on: ubuntu-latest
+    timeout-minutes: 240  # 4 hours for intense testing
     steps:
       # Check out repository with all submodules for complete codebase access.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           submodules: recursive
 
       # Install the Foundry toolchain.
       - name: Install Foundry
-        uses: foundry-rs/foundry-toolchain@v1
+        uses: foundry-rs/foundry-toolchain@82dee4ba654bd2146511f85f0d013af94670c4de # v1.4.0
         with:
           version: stable
 

.github/workflows/foundry.yml

@@ -9,6 +9,10 @@ on:
       - dev
   pull_request:
 
+permissions:
+  contents: read
+  actions: read  # Required for artifact upload
+
 env:
   FOUNDRY_PROFILE: ci
   RPC_MAINNET: ${{ secrets.RPC_MAINNET }}
@@ -23,15 +27,16 @@ jobs:
   test:
     name: Test
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       # Check out repository with all submodules for complete codebase access.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           submodules: recursive
 
       # Install the Foundry toolchain.
       - name: Install Foundry
-        uses: foundry-rs/foundry-toolchain@v1
+        uses: foundry-rs/foundry-toolchain@82dee4ba654bd2146511f85f0d013af94670c4de # v1.4.0
         with:
           version: stable
 
@@ -63,15 +68,16 @@ jobs:
   run-coverage:
     name: Coverage
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     steps:
       # Check out repository with all submodules for complete codebase access.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           submodules: recursive
 
       # Install the Foundry toolchain.
       - name: Install Foundry
-        uses: foundry-rs/foundry-toolchain@v1
+        uses: foundry-rs/foundry-toolchain@82dee4ba654bd2146511f85f0d013af94670c4de # v1.4.0
         with:
           version: stable
 
@@ -96,10 +102,11 @@ jobs:
 
       # Upload coverage report as artifact before potential failure
       - name: Upload Coverage Report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: code-coverage-report
           path: report/*
+          retention-days: 30
 
       # Check coverage threshold after uploading report
       - name: Check Coverage Threshold for >=90%

.github/workflows/storage-report.yml

@@ -10,17 +10,21 @@ on:
       - dev
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   check_storage:
     name: CI
     runs-on: "ubuntu-latest"
+    timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           submodules: recursive
 
       - name: Install Foundry
-        uses: foundry-rs/foundry-toolchain@v1
+        uses: foundry-rs/foundry-toolchain@82dee4ba654bd2146511f85f0d013af94670c4de # v1.4.0
         with:
           version: nightly
 
@@ -32,8 +36,17 @@ jobs:
         env:
           TARGET: ${{ github.event.pull_request.base.sha }}
         run: |
-          git fetch origin $TARGET
-          git checkout $TARGET
+          # Validate TARGET is a valid SHA (enhanced validation)
+          if [ -z "$TARGET" ]; then
+            echo "::error::TARGET SHA is empty"
+            exit 1
+          fi
+          if ! echo "$TARGET" | grep -qE '^[a-f0-9]{40}$'; then
+            echo "::error::Invalid SHA format: $TARGET"
+            exit 1
+          fi
+          git fetch origin "$TARGET"
+          git checkout "$TARGET"
 
       - name: "Generate and prepare the storage reports for target branch"
         run: |
@@ -46,4 +59,4 @@ jobs:
           else
             echo "::error::Differences found between PR and target branch storage layouts"
             exit 1
-          fi
+          fi