chore(ci): pin actions by commit SHA and tighten token permissions

.github/actions/setup-node/action.yml

@@ -4,11 +4,11 @@ runs:
   using: composite
   steps:
     - name: Install pnpm
-      uses: pnpm/action-setup@v4
+      uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
       with:
         run_install: false
     - name: Install Node.js
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
       with:
         node-version-file: .nvmrc
         cache: 'pnpm'

.github/workflows/api.yml

@@ -6,11 +6,16 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read # clone the repository (actions/checkout)
+
 jobs:
   api:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup-node
       - name: Build packages
         run: pnpm run build

.github/workflows/commitlint.yml

@@ -3,13 +3,13 @@ name: Commitlint
 on: [pull_request]
 
 permissions:
-  contents: read
+  contents: read # clone the repository (actions/checkout)
 
 jobs:
   commitlint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup-node

.github/workflows/deploy-pr-preview.yml

@@ -7,9 +7,9 @@ on:
   workflow_dispatch:
 
 permissions:
-  checks: write
-  contents: read
-  pull-requests: write
+  checks: write # create the "Deploy Preview" check run (action-hosting-deploy)
+  contents: read # clone the repository (actions/checkout)
+  pull-requests: write # comment on the PR with the preview URL (action-hosting-deploy)
 
 jobs:
   deploy-pr-preview:
@@ -18,18 +18,19 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: ./.github/actions/setup-node
 
       - name: Build Storybook
         run: pnpm run build-storybook
 
       - name: Deploy Preview
-        uses: FirebaseExtended/action-hosting-deploy@v0
+        uses: FirebaseExtended/action-hosting-deploy@500ac625ca2dd40cbd15f7659af953801858032a # v0.11.0
         with:
           repoToken: ${{ secrets.GITHUB_TOKEN }}
           firebaseServiceAccount: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_KOOBIQ }}

.github/workflows/docs-stable.yml

@@ -6,13 +6,18 @@ on:
       - '[0-9]+.[0-9]+.[0-9]+*'
   workflow_dispatch:
 
+permissions:
+  contents: read # clone the repository (actions/checkout)
+
 jobs:
   deploy-stable-docs:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - uses: ./.github/actions/setup-node
 

.github/workflows/linters.yml

@@ -6,11 +6,16 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read # clone the repository (actions/checkout)
+
 jobs:
   linters:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup-node
       - name: Type check
         run: pnpm run type-check

.github/workflows/pr-notification.yml

@@ -5,6 +5,8 @@ on:
     types:
       - opened
 
+permissions: {} # none needed: the job only posts to a Mattermost webhook
+
 jobs:
   notify:
     runs-on: ubuntu-latest
@@ -14,7 +16,7 @@ jobs:
     steps:
       - name: Notification to main channel
         if: ${{ github.actor != 'dependabot[bot]' }}
-        uses: mattermost/action-mattermost-notify@v2.1.0
+        uses: mattermost/action-mattermost-notify@ae31bb6f9e26a54336e79696f108a2c91cf55b4e # v2.1.0
         env:
           NODE_TLS_REJECT_UNAUTHORIZED: '0'
         with:
@@ -24,7 +26,7 @@ jobs:
           TEXT: ${{ env.TEXT }}
 
       - name: Notification to dev channel
-        uses: mattermost/action-mattermost-notify@v2.1.0
+        uses: mattermost/action-mattermost-notify@ae31bb6f9e26a54336e79696f108a2c91cf55b4e # v2.1.0
         env:
           NODE_TLS_REJECT_UNAUTHORIZED: '0'
         with:

.github/workflows/release.yml

@@ -7,9 +7,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  id-token: write
-  contents: write
-  packages: write
+  contents: write # clone the repository and create the GitHub release (upload-release-action)
 
 jobs:
   release:
@@ -19,9 +17,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: ./.github/actions/setup-node
 
@@ -36,13 +35,13 @@ jobs:
 
       - name: Parse Changelog
         id: changelog
-        uses: ocavue/changelog-parser-action@v1
+        uses: ocavue/changelog-parser-action@0260f7a77c97ed295575683c8036b81724fd34f5 # v1.2.0
         with:
           removeMarkdown: false
           filePath: './CHANGELOG.md'
 
       - name: Upload Binaries to Release
-        uses: svenstaro/upload-release-action@v2
+        uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # 2.11.5
         with:
           repo_token: ${{ secrets.GITHUB_TOKEN }}
           tag: ${{ steps.changelog.outputs.latestVersion }}
@@ -51,7 +50,7 @@ jobs:
             ${{ steps.changelog.outputs.latestBody }}
 
       - name: Notify Mattermost
-        uses: mattermost/action-mattermost-notify@v2.1.0
+        uses: mattermost/action-mattermost-notify@ae31bb6f9e26a54336e79696f108a2c91cf55b4e # v2.1.0
         env:
           NODE_TLS_REJECT_UNAUTHORIZED: '0'
         with:

.github/workflows/units.yml

@@ -6,10 +6,15 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read # clone the repository (actions/checkout)
+
 jobs:
   unit_tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup-node
       - run: pnpm run test --run