Harden CI supply chain settings (#49)

* chore: replace deprecated xref exclude with elixirc_options

* ci: update runner to ubuntu-24.04 and refresh test matrix

- ubuntu-20.04 runner image was removed from GitHub Actions in April 2025
- Add Elixir 1.19 (latest stable) and move lint target to 1.19 + OTP 28
- Drop Elixir 1.12, 1.13, 1.14 (no longer in security support upstream)
- Drop OTP < 24.3 since they are not provided on ubuntu-22.04/24.04

* chore: bump minimum Elixir version to 1.15

Align the supported Elixir version with what the CI matrix actually tests.
Elixir < 1.15 is no longer in security support upstream and is not
exercised by CI.

* chore: harden supply chain in CI

* ci: keep dev dependencies available for lock checks

Author: k-asm

.github/workflows/ci.yml

@@ -1,6 +1,9 @@
 name: CI
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build and test
@@ -34,12 +37,12 @@ jobs:
           - elixir: 1.15.x
             otp: 24.x
     steps:
-      - uses: actions/checkout@v4
-      - uses: erlef/setup-beam@v1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.24.0
         with:
           elixir-version: ${{ matrix.elixir }}
           otp-version: ${{ matrix.otp }}
-      - run: mix deps.get
+      - run: mix deps.get --check-locked
       - run: mix deps.compile
       - run: mix compile --warnings-as-errors
         if: ${{ matrix.lint }}

mix.exs

@@ -54,7 +54,7 @@ defmodule Params.Mixfile do
   defp deps do
     [
       {:ecto, "~> 2.0 or ~> 3.0"},
-      {:ex_doc, ">= 0.0.0", only: :dev, runtime: false},
+      {:ex_doc, "~> 0.34", only: :dev, runtime: false},
       {:dialyxir, "~> 0.5", only: :dev, runtime: false}
     ]
   end