ci: harden UltraModern GitHub Actions workflows

[BleedingDev]

Summary

• apply the GitHub Actions hardening from the upstream Modern.js PR onto main-ultramodern without changing fork-specific mise setup
• set checkout persist-credentials: false where jobs only need read access
• keep skip-CI output interpolation routed through environment variables before shell use
• move GitHub Pages deployment permissions from workflow scope to the deploy job

Verification

• uvx zizmor -q --format json --no-progress --no-exit-codes --collect=workflows .github/workflows
  • after: 1 finding, H1/M0/L0/I0
• /Users/satan/side/experiments/skills/actionlint/scripts/run_actionlint.sh /Users/satan/worktrees/ultramodern-zizmor-actions
• git diff --cached --check before commit

Remaining zizmor finding

• dangerous-triggers in .github/workflows/ultramodern-production-readiness.yml: existing workflow_run behavior is preserved because changing it would alter readiness proof semantics after package publishing.

Upstream PR left open for Modern.js review: web-infra-dev#8728

[bolt-new-by-stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[semanticdiff-com]

Review changes with  

Changed Files

File	Status
.github/workflows/lint-Linux.yml	67% smaller
.github/workflows/docs-pages.yml	23% smaller
.github/workflows/integration-test-Linux.yml	20% smaller
.github/workflows/type-check.yml	20% smaller
.github/workflows/ut-macOS.yml	20% smaller
.github/workflows/integration-test-Windows.yml	12% smaller
.github/workflows/ut-Windows.yml	12% smaller
.github/workflows/check-dependencies.yml	0% smaller
.github/workflows/diff.yml	0% smaller
.github/workflows/test-builder-e2e.yml	0% smaller

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a64b678180

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve credentials before running skipCI

When this workflow runs in a private/internal repository, the immediately following Check skip CI step invokes scripts/skipCI.js, which starts with git fetch origin main. actions/checkout documents that persisted credentials are what let later scripts run authenticated git commands, and setting persist-credentials: false opts out, so that fetch will fail before the tests can run or be skipped. This same pattern is repeated in the other skip-CI workflows changed here; either keep credentials for these jobs or authenticate the fetch explicitly.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Grant Pages read permission to the build job

When this workflow is used from a private repository or fork, actions/configure-pages@v6 calls the GitHub Pages getPages API, which requires Pages read permission. This job-level permissions block grants only contents: read (unspecified scopes become none), so the Configure Pages step fails with Resource not accessible by integration before any artifact is uploaded; add pages: read to the build job while keeping write/OIDC limited to deploy.

Useful? React with 👍 / 👎.