From 63cf5ed9f3afe66a9c3e20fa443d489ca206257d Mon Sep 17 00:00:00 2001 From: Mark Stuart Date: Sat, 22 Aug 2026 22:20:52 -0700 Subject: [PATCH] ci: harden GitHub Actions workflows --- .github/workflows/ci.yml | 7 +++++-- .github/workflows/release.yml | 4 ++-- .github/workflows/security-audit.yml | 4 ++-- 3 files changed, 9 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5dac1a8..51a1a11 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -5,6 +5,9 @@ on: branches: [main] pull_request: +permissions: + contents: read + jobs: test: runs-on: ubuntu-latest @@ -12,8 +15,8 @@ jobs: matrix: node-version: [20, 22, 24] steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: ${{ matrix.node-version }} cache: npm diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7bb0f05..60afa98 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -12,8 +12,8 @@ jobs: contents: write id-token: write steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 20 registry-url: https://registry.npmjs.org diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml index b218b03..cb47cef 100644 --- a/.github/workflows/security-audit.yml +++ b/.github/workflows/security-audit.yml @@ -26,8 +26,8 @@ jobs: audit: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-node@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 with: node-version: 22 # Some repos intentionally ship without a committed lockfile; `npm ci`