ci: harden CMake workflow execution

[Alb3e3]

The CMake workflow only needs repository read access, but currently inherits the repository's default token permissions, checks out a mutable action tag, and interpolates its generated build directory directly into shell source.

This PR makes three changes in that workflow:

• Set permissions: contents: read. Checkout needs to read repository contents; the build and test jobs do not publish artifacts or write to GitHub through GITHUB_TOKEN. An explicit scope avoids inheriting broader repository defaults and limits what a compromised build step could do with that token. It does not prevent writes to the runner's local workspace.
• Pin actions/checkout v3 to a37ce9120846195fa4ece8f58b268e6043cb2f26. A commit reference fixes the reviewed action implementation instead of following a movable tag. The # v3 comment retains the version context. Future action updates require updating the pin; this does not claim that the pinned action has no vulnerabilities.
• Pass steps.strings.outputs.build-output-dir through BUILD_OUTPUT_DIR and quote the shell variable in Configure, Build, and Test. This keeps the value as a single shell argument rather than inserting it into the command's source text. The current value is generated inside this workflow, so this is defensive hardening, not a demonstrated attacker-controlled injection vulnerability.

The GitHub Actions Scan run reported unpinned-uses for checkout and template-injection for those three output interpolations. These changes address those findings. The explicit token scope is a separate least-privilege improvement; the earlier wording about ?mandatory checks? was too broad and did not establish a repository branch-protection requirement.

The build matrix and build/test commands are otherwise unchanged. I have kept these changes together because they affect the same small workflow; each change is explained above so it can be reviewed independently.

Validation of the existing code change:

• YAML parse
• zizmor 1.25.2 with strict collection and medium confidence: no findings
• git diff --check

AI assistance: this description was revised with OpenAI Codex and checked against the PR diff and review discussion.

[vitalybuka]

satisfying the mandatory GitHub Actions checks for this repository.

Can you please clarify why this PR is needed, e.g. what is "mandatory GitHub Actions checks"?

[Alb3e3]

Thanks for asking. By “mandatory GitHub Actions checks,” I meant the repository’s required GitHub Actions Scan workflow, not the CMake build matrix.

On the original version of this file, the scan reported four blocking findings in .github/workflows/cmake-multi-platform.yml:

• template-injection on the three steps.strings.outputs.build-output-dir interpolations in the CMake, Build, and Test commands
• unpinned-uses for actions/checkout@v3

The scan output is here: https://github.com/google/libprotobuf-mutator/actions/runs/34440003668

This PR fixes those findings by passing the directory through the step environment, quoting it in the shell commands, and pinning checkout to a commit. It also limits the job token to contents: read. The build matrix and commands are otherwise unchanged.

If this scan is not intended to gate the repository, I can close the PR.

[vitalybuka]

I don't have much experience with actions, so I need to do some research to review.

So in the main description could you add to each changed item explanation WHY?

I'd prefer to keep separate changed to separate PRs, leaving it up to you if you want to split.

[Alb3e3]

Updated the main description with the reason for each of the three changes and their limits. I also replaced the ambiguous ?mandatory checks? wording with the specific scan findings and run link. The current build-directory value is generated within this workflow, so I have described that change as defensive hardening rather than a demonstrated attacker-controlled injection.

I kept the changes together because they affect the same small workflow, with a separate rationale for each item so they can be reviewed independently.

[vitalybuka]

LGTM. Thank you!