fix(ci): pin GitHub Actions to commit SHAs and restrict GITHUB_TOKEN permissions

Resolve OpenSSF Scorecard alerts for TokenPermissions and PinnedDependencies
by pinning all GitHub Actions to commit SHAs, hash-pinning pip install commands,
and moving write permissions from workflow-level to job-level.

Author: markuslf

.github/workflows/codeql.yml

@@ -19,6 +19,8 @@ on:
   schedule:
     - cron: '35 11 * * 6'
 
+permissions: read-all
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
@@ -57,7 +59,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`
@@ -67,7 +69,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -95,6 +97,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/dependency-review.yml

@@ -11,12 +11,12 @@ jobs:
     runs-on: 'ubuntu-latest'
     steps:
       - name: 'Harden Runner'
-        uses: 'step-security/harden-runner@v2'
+        uses: 'step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d' # v2.16.1
         with:
           egress-policy: 'audit'
 
       - name: 'Checkout repository'
-        uses: 'actions/checkout@v6'
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # v6.0.2
 
       - name: 'Dependency Review'
-        uses: 'actions/dependency-review-action@v4'
+        uses: 'actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48' # v4.9.0

.github/workflows/docs.yml

@@ -19,17 +19,17 @@ jobs:
     runs-on: 'ubuntu-latest'
     steps:
       - name: 'Checkout repository'
-        uses: 'actions/checkout@v6'
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # v6.0.2
 
       - name: 'Set up Python'
-        uses: 'actions/setup-python@v6'
+        uses: 'actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405' # v6.2.0
         with:
           python-version: '3.12'
 
       - name: 'Install dependencies'
         run: |
           pip install --editable .
-          pip install pdoc
+          pip install --require-hashes --requirement /dev/stdin <<< "pdoc==16.0.0 --hash=sha256:070b51de2743b9b1a4e0ab193a06c9e6c12cf4151cf9137656eebb16e8556628"
 
       - name: 'Build documentation'
         run: 'pdoc --output-directory docs lib'
@@ -38,7 +38,7 @@ jobs:
         run: 'touch docs/.nojekyll'
 
       - name: 'Upload Pages artifact'
-        uses: 'actions/upload-pages-artifact@v4'
+        uses: 'actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b' # v4.0.0
         with:
           path: 'docs'
 
@@ -51,4 +51,4 @@ jobs:
     steps:
       - name: 'Deploy to GitHub Pages'
         id: 'deployment'
-        uses: 'actions/deploy-pages@v5'
+        uses: 'actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128' # v5.0.0

.github/workflows/pre-commit-autoupdate.yml

@@ -5,30 +5,31 @@ on:
     - cron: '0 8 * * 1'
   workflow_dispatch: {}
 
-permissions:
-  contents: 'write'
-  pull-requests: 'write'
+permissions: read-all
 
 jobs:
   update:
     runs-on: 'ubuntu-latest'
+    permissions:
+      contents: 'write'
+      pull-requests: 'write'
     steps:
       - name: 'Checkout repository'
-        uses: 'actions/checkout@v6'
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # v6.0.2
 
       - name: 'Set up Python'
-        uses: 'actions/setup-python@v6'
+        uses: 'actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405' # v6.2.0
         with:
           python-version: '3.12'
 
       - name: 'Install pre-commit'
-        run: 'pip install pre-commit'
+        run: 'pip install --require-hashes --requirement /dev/stdin <<< "pre-commit==4.5.1 --hash=sha256:3b3afd891e97337708c1674210f8eba659b52a38ea5f822ff142d10786221f77"'
 
       - name: 'Run pre-commit autoupdate'
         run: 'pre-commit autoupdate'
 
       - name: 'Create Pull Request'
-        uses: 'peter-evans/create-pull-request@v8'
+        uses: 'peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0' # v8.1.0
         with:
           commit-message: 'chore: update pre-commit hooks'
           title: 'chore: update pre-commit hooks'

.github/workflows/release.yml

@@ -14,21 +14,21 @@ jobs:
     runs-on: 'ubuntu-latest'
     steps:
       - name: 'Checkout repository'
-        uses: 'actions/checkout@v6'
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # v6.0.2
 
       - name: 'Set up Python'
-        uses: 'actions/setup-python@v6'
+        uses: 'actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405' # v6.2.0
         with:
           python-version: '3.12'
 
       - name: 'Install build tools'
-        run: 'pip install --upgrade build'
+        run: 'pip install --require-hashes --requirement /dev/stdin <<< "build==1.4.2 --hash=sha256:7a4d8651ea877cb2a89458b1b198f2e69f536c95e89129dbf5d448045d60db88"'
 
       - name: 'Build package'
         run: 'python -m build'
 
       - name: 'Upload build artifacts'
-        uses: 'actions/upload-artifact@v7'
+        uses: 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' # v7.0.0
         with:
           name: 'dist'
           path: 'dist/'
@@ -44,13 +44,13 @@ jobs:
       id-token: 'write'
     steps:
       - name: 'Download build artifacts'
-        uses: 'actions/download-artifact@v8'
+        uses: 'actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c' # v8.0.1
         with:
           name: 'dist'
           path: 'dist/'
 
       - name: 'Publish to TestPyPI'
-        uses: 'pypa/gh-action-pypi-publish@release/v1'
+        uses: 'pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc' # v1.12.4
         with:
           repository-url: 'https://test.pypi.org/legacy/'
 
@@ -65,10 +65,10 @@ jobs:
       id-token: 'write'
     steps:
       - name: 'Download build artifacts'
-        uses: 'actions/download-artifact@v8'
+        uses: 'actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c' # v8.0.1
         with:
           name: 'dist'
           path: 'dist/'
 
       - name: 'Publish to PyPI'
-        uses: 'pypa/gh-action-pypi-publish@release/v1'
+        uses: 'pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc' # v1.12.4

.github/workflows/scorecard.yml

@@ -17,30 +17,30 @@ jobs:
 
     steps:
       - name: 'Harden Runner'
-        uses: 'step-security/harden-runner@v2'
+        uses: 'step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d' # v2.16.1
         with:
           egress-policy: 'audit'
 
       - name: 'Checkout code'
-        uses: 'actions/checkout@v6'
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # v6.0.2
         with:
           persist-credentials: false
 
       - name: 'Run analysis'
-        uses: 'ossf/scorecard-action@v2.4.3'
+        uses: 'ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a' # v2.4.3
         with:
           results_file: 'results.sarif'
           results_format: 'sarif'
           publish_results: true
 
       - name: 'Upload artifact'
-        uses: 'actions/upload-artifact@v7'
+        uses: 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' # v7.0.0
         with:
           name: 'SARIF file'
           path: 'results.sarif'
           retention-days: 5
 
       - name: 'Upload to code-scanning'
-        uses: 'github/codeql-action/upload-sarif@v4'
+        uses: 'github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13' # v4
         with:
           sarif_file: 'results.sarif'