From b7f88afa61eff92e23573daab169188856c4c419 Mon Sep 17 00:00:00 2001
From: Saul Beck <saul.beck@stfc.ac.uk>
Date: Mon, 29 Jun 2026 12:13:11 +0100
Subject: [PATCH] CI: Hardening

---
 .github/workflows/build.yaml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 2a69aa8..8812d50 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -6,10 +6,16 @@ on:
       - main
   pull_request:
 
+permissions: {}
+
 jobs:
   build:
     name: Build (${{ matrix.runner }})
     runs-on: ${{ matrix.runner }}
+
+    permissions: 
+      contents: read
+
     strategy:
       matrix:
         runner:
@@ -18,10 +24,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up JDK 11
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
         with:
           java-version: "11"
           distribution: temurin