ci: fix security issues (#4122)

Author: Barsnes

.github/workflows/azure-deploy-storybook.yml

@@ -47,7 +47,7 @@ jobs:
     outputs:
       fqdn: ${{ steps.fqdn.outputs.fqdn }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: az login (oidc)
         uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0

.github/workflows/azure-deploy-themebuilder.yml

@@ -47,7 +47,7 @@ jobs:
     outputs:
       fqdn: ${{ steps.fqdn.outputs.fqdn }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: az login (oidc)
         uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0

.github/workflows/azure-deploy-www.yml

@@ -47,7 +47,7 @@ jobs:
     outputs:
       fqdn: ${{ steps.fqdn.outputs.fqdn }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: az login (oidc)
         uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0

.github/workflows/azure-preview-cleanup.yml

@@ -19,7 +19,7 @@ jobs:
     if: ${{ github.repository == 'digdir/designsystemet' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: az login (oidc)
         uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0

.github/workflows/preview-comment.yml

@@ -32,21 +32,21 @@ jobs:
             **Preview deployments for this pull request:**
 
       - name: Find Storybook deployment
-        uses: actions-ecosystem/action-regex-match@v2
+        uses: actions-ecosystem/action-regex-match@9e6c4fb3d5e898f505be7a1fb6e7b0a278f6665b # v2.0.2
         id: regex-storybook
         with:
           text: ${{ steps.fc.outputs.comment-body }}
           regex: '(\[storybook\]\([^)]+\)[^\n]*)'
 
       - name: Find Theme deployment
-        uses: actions-ecosystem/action-regex-match@v2
+        uses: actions-ecosystem/action-regex-match@9e6c4fb3d5e898f505be7a1fb6e7b0a278f6665b # v2.0.2
         id: regex-theme
         with:
           text: ${{ steps.fc.outputs.comment-body }}
           regex: '(\[themebuilder\]\([^)]+\)[^\n]*)'
 
       - name: Find www deployment
-        uses: actions-ecosystem/action-regex-match@v2
+        uses: actions-ecosystem/action-regex-match@9e6c4fb3d5e898f505be7a1fb6e7b0a278f6665b # v2.0.2
         id: regex-www
         with:
           text: ${{ steps.fc.outputs.comment-body }}

.github/workflows/release.yml

@@ -13,6 +13,11 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    permissions:
+      contents: write
+      pull-requests: write
+      id-token: write
+      packages: write
     outputs:
       published: ${{ steps.changesets.outputs.published }}
     steps:
@@ -27,7 +32,7 @@ jobs:
       - name: Create Release Pull Request or Publish to npm
         id: changesets
         # Forked version of the changesets action that supports aggregated releases
-        uses: dotansimha/changesets-action@v1.5.2
+        uses: dotansimha/changesets-action@069996e9be15531bd598272996fa23853d61590e # v1.5.2
         with:
           publish: pnpm publish-packages
           version: pnpm version-packages
@@ -44,6 +49,10 @@ jobs:
 
 
   deploy-www:
+    permissions:
+      id-token: write
+      contents: read
+      pull-requests: write
     needs: release
     if: ${{ needs.release.outputs.published == 'true' }}
     uses: ./.github/workflows/azure-deploy-www.yml
@@ -54,6 +63,10 @@ jobs:
       AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
       AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
   deploy-theme:
+    permissions:
+      id-token: write
+      contents: read
+      pull-requests: write
     needs: release
     if: ${{ needs.release.outputs.published == 'true' }}
     uses: ./.github/workflows/azure-deploy-themebuilder.yml
@@ -64,6 +77,10 @@ jobs:
       AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
       AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
   deploy-storybook:
+    permissions:
+        id-token: write
+        contents: read
+        pull-requests: write
     needs: release
     if: ${{ needs.release.outputs.published == 'true' }}
     uses: ./.github/workflows/azure-deploy-storybook.yml