From 901b716eb18b4da0eb4251f738e5dbc4c11a405c Mon Sep 17 00:00:00 2001 From: Mark Stuart Date: Sat, 22 Aug 2026 22:20:52 -0700 Subject: [PATCH] ci: harden GitHub Actions workflows --- .github/workflows/ci.yml | 7 +++++-- .github/workflows/release.yml | 4 ++-- .github/workflows/security-audit.yml | 4 ++-- 3 files changed, 9 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8a98b14..019b48b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,6 +6,9 @@ on: pull_request: workflow_dispatch: +permissions: + contents: read + jobs: test: runs-on: ubuntu-latest @@ -16,9 +19,9 @@ jobs: node: ['22', '24'] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: ${{ matrix.node }} cache: npm diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2a39fc4..265929f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -25,8 +25,8 @@ jobs: release: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 22 registry-url: "https://registry.npmjs.org" diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml index b218b03..cb47cef 100644 --- a/.github/workflows/security-audit.yml +++ b/.github/workflows/security-audit.yml @@ -26,8 +26,8 @@ jobs: audit: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-node@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 with: node-version: 22 # Some repos intentionally ship without a committed lockfile; `npm ci`