Merge #24: Address code scanning results

7712c69 ci(dependabot): Configure cooldown (valued mammal)
d0b0596 ci: Limit token permissions (valued mammal)
edce0c3 ci: Pin `setup-rust-toolchain` to a commit (valued mammal)
7f18365 ci: Bump `actions/checkout` to v6 (valued mammal)
3c437a2 ci: Set `persist-credentials` false on checkout (valued mammal)
346367b ci(audit): Remove undefined `deny` input from rustsec/audit-check (valued mammal)

Pull request description:

  ### Description

  This PR is meant to address the warnings surfaced by zizmor's code scanning results. See the [Security tab](https://github.com/bitcoindevkit/bdk-bitcoind-client/security/code-scanning) for details.

  Key changes

  - No longer persist credentials upon checking out the repository
  - Ensure actions are pinned to a commit hash
  - Fix overly broad permissions
  - Configure cooldown (7 days) of dependabot updates
  - Update `actions/checkout` to actions/checkout@8e8c483 (v6)

  ### Notes to the reviewers

  The `audit.yml` workflow was setting a "deny" action input to be used by `rustsec/audit-check`, but according to the [documentation](https://github.com/rustsec/audit-check?tab=readme-ov-file#inputs) this doesn't appear to be a valid input, hence removed it in 346367b.

  ### Changelog notice

  - ci: Bump `actions/checkout` to v6

  ### Checklists

  #### All Submissions:

  * [x] I've signed all my commits

ACKs for top commit:
  luisschwab:
    ACK 7712c69
  tvpeter:
    ACK 7712c69

Tree-SHA512: 8336bf63de3db31b5b9774578f192297d607b2e8053b68b3fe3d748f81579aec99f6d1a3565ef3fd41a2caf4ee0b30ccc04196075a4b316f151c3517e3d794c9

Author: tvpeter

.github/dependabot.yml

@@ -1,18 +1,21 @@
 version: 2
-enable-beta-ecosystems: true   
+enable-beta-ecosystems: true
 
 updates:
-  
+
   - package-ecosystem: github-actions
     directory: "/"
     schedule:
-      interval: daily     
-      time: "03:00"       
-   
+      interval: daily
+      time: "03:00"
+    cooldown:
+      default-days: 7
+
   - package-ecosystem: cargo
     directory: "/"
     schedule:
       interval: weekly
       day: monday
       time: "04:00"
- 
+    cooldown:
+      default-days: 7

.github/workflows/audit.yml

@@ -10,29 +10,31 @@ on:
       - '**/Cargo.toml'
       - '**/Cargo.lock'
   schedule:
-    # weekly
-    - cron: '0 0 * * 0'
+    - cron: '0 0 * * 0' # At 00:00 on Sunday
   workflow_dispatch:
 
 env:
   CARGO_TERM_COLOR: always
 
-permissions:
-  contents: read
-  security-events: write   
-  issues: write            
+permissions: {}
 
 jobs:
   cargo-audit:
     name: RustSec Audit (vulnerabilities)
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    permissions:
+      contents: read
+      security-events: write
+      issues: write
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        with:
+          persist-credentials: false
       - name: Install Rust toolchain and configure cache
-        uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c
+        uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1
         with:
           toolchain: stable
           cache: true
@@ -47,4 +49,3 @@ jobs:
         uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          deny: warnings

.github/workflows/cont_integration.yml

@@ -2,6 +2,8 @@ on: [push, pull_request]
 
 name: CI
 
+permissions: {}
+
 env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: 1
@@ -12,15 +14,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-      
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        with:
+          persist-credentials: false
       - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1
         with:
           toolchain: stable
           components: rustfmt
           cache: true
-      
+
       - name: Check fmt
         run: cargo fmt --all -- --check
 
@@ -34,10 +37,11 @@ jobs:
           - --no-default-features
           - --all-features
     steps:
-      - uses: actions/checkout@v4
-      
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        with:
+          persist-credentials: false
       - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1
         with:
           toolchain: stable
           components: clippy
@@ -57,20 +61,21 @@ jobs:
           - --no-default-features
           - --all-features
     steps:
-      - uses: actions/checkout@v4
-      
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        with:
+          persist-credentials: false
       - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1
         with:
           toolchain: stable
           cache: true
-      
+
       - name: Build
         run: cargo build ${{ matrix.features }} --verbose
-      
+
       - name: Run unit tests
         run: cargo test ${{ matrix.features }} --lib --verbose
-      
+
       - name: Run doc tests
         run: cargo test ${{ matrix.features }} --doc --verbose
 
@@ -79,13 +84,14 @@ jobs:
     name: MSRV
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        with:
+          persist-credentials: false
       - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1
         with:
           toolchain: 1.75.0
           cache: true
-          
+
       - name: Check MSRV
         run: cargo check --all-features

.github/workflows/zizmor.yml

@@ -1,26 +1,30 @@
 name: GitHub Actions Security Analysis with zizmor
 
 on:
-  pull_request:                  
+  pull_request:
+    branches: ["**"]
+  push:
     branches: ["**"]
-  push:                          
-    branches: ["**"]             
   schedule:
-    - cron: '0 0 * * 0'          
-  workflow_dispatch:            
+    - cron: '0 0 * * 0' # At 00:00 on Sunday
+  workflow_dispatch:
 
-permissions:
-  contents: read
-  security-events: write         
+permissions: {}
 
 jobs:
   zizmor:
     name: zizmor security scan
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    permissions:
+      contents: read
+      security-events: write
+
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        with:
+          persist-credentials: false
 
-      - name: Run zizmor 
-        uses: zizmorcore/zizmor-action@135698455da5c3b3e55f73f4419e481ab68cdd95  
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@135698455da5c3b3e55f73f4419e481ab68cdd95