Update workflow permissions and versions

.github/dependabot.yml

@@ -9,3 +9,12 @@ updates:
     directory: "/" # Location of package manifests
     schedule:
       interval: "daily"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: "chore: "

.github/workflows/build_and_publish.yaml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: checkout
-      uses: actions/checkout@master
+      uses: actions/checkout@v6
     - uses: extractions/setup-just@69d82fb0233557aec017ef13706851d0694e0f1d
     - name: Build image
       run: just build

.github/workflows/check-auth-header.yaml

@@ -4,13 +4,15 @@ on:
     # 09:00 UTC every day
     - cron: '0 9 * * *'
   workflow_dispatch:
+permissions:
+  contents: read
 env:
   EXPECTED: 'realm="https://ghcr.io/token",service="ghcr.io",scope="repository:user/image:pull"'
 jobs:
   check:
     runs-on: ubuntu-latest
     steps:
     - name: checkout
-      uses: actions/checkout@master
+      uses: actions/checkout@v6
     - name: check
       run: python3 check-header.py

.github/workflows/tests.yaml

@@ -3,12 +3,14 @@ on:
   pull_request:
 env:
   IMAGE_NAME: opensafely-proxy
+permissions:
+  contents: read
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
     - name: checkout
-      uses: actions/checkout@master
+      uses: actions/checkout@v6
     - uses: extractions/setup-just@69d82fb0233557aec017ef13706851d0694e0f1d
     - name: Build image
       run: just build