chore: Update and pin all GHA actions (#742)

Author: mjameswh

.github/workflows/docs.yml

@@ -5,16 +5,23 @@ on:
     branches:
       - "master"
 
+permissions:
+  contents: read
+  actions: write
+
 jobs:
   docs:
+    permissions:
+      contents: read
+      actions: write
     name: Generating API documentation
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           submodules: recursive
 
-      - uses: actions/setup-node@v1
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           node-version: 20
 
@@ -23,7 +30,7 @@ jobs:
 
       - name: Cache phpDocumentor build files
         id: phpdocumentor-cache
-        uses: actions/cache@v3
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: .phpdoc/cache
           key: ${{ runner.os }}-phpdocumentor-${{ github.sha }}

.github/workflows/run-test-suite.yml

@@ -38,8 +38,13 @@ on:
       - 'psalm-baseline.xml'
       - '.editorconfig'
 
+permissions:
+  contents: read
+
 jobs:
   test:
+    permissions:
+      contents: read
     name: PHP${{ matrix.php }}${{ matrix.extensions-suffix }}, ${{ matrix.os }}, ${{ matrix.dependencies }} deps
     runs-on: ${{ matrix.os }}
     timeout-minutes: ${{ inputs.test-timeout }}
@@ -65,10 +70,10 @@ jobs:
           git config --global core.eol lf
 
       - name: Check Out Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup PHP ${{ matrix.php }}
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
         with:
           php-version: ${{ matrix.php }}
           extensions: dom, sockets, grpc, curl ${{ matrix.extensions-suffix }}
@@ -77,7 +82,7 @@ jobs:
         run: composer validate --strict
 
       - name: Install dependencies with composer
-        uses: ramsey/composer-install@v3
+        uses: ramsey/composer-install@5c2bcf28d7b060ef3c601d7b476d5430a7b46c27 # v4
         with:
           dependency-versions: ${{ matrix.dependencies }}
 

.github/workflows/security-check.yml

@@ -2,12 +2,17 @@ name: Security
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 concurrency:
   cancel-in-progress: ${{ !contains(github.ref, 'release/')}}
   group: tests-${{ github.workflow }}-${{ github.ref }}
 
 jobs:
   security:
+    permissions:
+      contents: read
     name: Security Checks (PHP ${{ matrix.php }}, OS ${{ matrix.os }})
     runs-on: ${{ matrix.os }}
     strategy:
@@ -18,16 +23,16 @@ jobs:
         os: [ ubuntu-latest ]
     steps:
       - name: Set up PHP ${{ matrix.php }}
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
         with:
           php-version: ${{ matrix.php }}
           extensions: dom, sockets, grpc, curl
 
       - name: Check Out Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Install dependencies with composer
-        uses: ramsey/composer-install@v3
+        uses: ramsey/composer-install@5c2bcf28d7b060ef3c601d7b476d5430a7b46c27 # v4
         with:
           dependency-versions: ${{ matrix.dependencies }}
 

.github/workflows/static-analysis.yml

@@ -2,12 +2,17 @@ name: Static Analysis
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 concurrency:
   cancel-in-progress: ${{ !contains(github.ref, 'release/')}}
   group: tests-${{ github.workflow }}-${{ github.ref }}
 
 jobs:
   psalm:
+    permissions:
+      contents: read
     name: Psalm Validation (PHP ${{ matrix.php }}, OS ${{ matrix.os }})
     runs-on: ${{ matrix.os }}
     continue-on-error: true
@@ -18,23 +23,25 @@ jobs:
         os: [ubuntu-latest]
     steps:
       - name: Set up PHP ${{ matrix.php }}
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
         with:
           php-version: ${{ matrix.php }}
           extensions: dom
 
       - name: Check Out Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Install dependencies with composer
-        uses: ramsey/composer-install@v3
+        uses: ramsey/composer-install@5c2bcf28d7b060ef3c601d7b476d5430a7b46c27 # v4
         with:
           dependency-versions: ${{ matrix.dependencies }}
 
       - name: 🔍 Run Tests
         run: vendor/bin/psalm
 
   arch:
+    permissions:
+      contents: read
     name: Architecture tests
     runs-on: ${{ matrix.os }}
     continue-on-error: true
@@ -45,18 +52,18 @@ jobs:
         os: [ubuntu-latest]
     steps:
       - name: Set up PHP ${{ matrix.php }}
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
         with:
           php-version: ${{ matrix.php }}
           extensions: dom
 
       - name: Check Out Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 1
 
       - name: Install dependencies with composer
-        uses: ramsey/composer-install@v3
+        uses: ramsey/composer-install@5c2bcf28d7b060ef3c601d7b476d5430a7b46c27 # v4
         with:
           dependency-versions: ${{ matrix.dependencies }}
 

.github/workflows/testing.yml

@@ -2,19 +2,26 @@ name: Testing
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 concurrency:
   cancel-in-progress: ${{ !contains(github.ref, 'release/')}}
   group: tests-${{ github.workflow }}-${{ github.ref }}
 
 jobs:
   unit:
+    permissions:
+      contents: read
     name: Unit Testing
     uses: ./.github/workflows/run-test-suite.yml
     with:
       fail-fast: false
       test-command: composer test:unit
 
   functional:
+    permissions:
+      contents: read
     name: Functional Testing
     uses: ./.github/workflows/run-test-suite.yml
     with:
@@ -23,6 +30,8 @@ jobs:
       download-binaries: true
 
   acceptance-slow:
+    permissions:
+      contents: read
     name: Acceptance Testing (Slow)
     uses: ./.github/workflows/run-test-suite.yml
     with:
@@ -31,6 +40,8 @@ jobs:
       download-binaries: true
 
   acceptance-fast:
+    permissions:
+      contents: read
     name: Acceptance Testing (Fast)
     uses: ./.github/workflows/run-test-suite.yml
     with: