From 3898dbf790f025eb880bdcef4c9c99d82773c06c Mon Sep 17 00:00:00 2001
From: Oskar Eichler <oskar@songstats.com>
Date: Fri, 4 Sep 2026 22:30:42 +0700
Subject: [PATCH] Pin workflow dependencies and permissions

---
 .github/workflows/labels.yml  | 10 ++++++++--
 .github/workflows/linting.yml | 16 ++++++++++------
 .github/workflows/locking.yml |  9 +++++++--
 .github/workflows/testing.yml |  8 ++++++--
 4 files changed, 31 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 32386e0..63a3a4e 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -6,19 +6,25 @@ on:
   - "workflow_dispatch"
 
 name:                             "Labels"
+
+permissions:
+  contents:                       "read"
+  issues:                         "write"
+
 jobs:
   synchronize-labels:
     name:                         "Synchronize Labels"
     runs-on:                      "ubuntu-latest"
     steps:
       - name:                     "Checkout Code"
-        uses:                     "actions/checkout@v3"
+        uses:                     "actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26" # v3
         timeout-minutes:          5
         with:
           fetch-depth:            0
+          persist-credentials:    false
 
       - name:                     "Synchronize Labels"
-        uses:                     "micnncim/action-label-syncer@v1"
+        uses:                     "micnncim/action-label-syncer@3abd5ab72fda571e69fffd97bd4e0033dd5f495c" # v1
         with:
           manifest:               ".github/labels.yml"
         env:
diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml
index 04bb498..013d1e7 100644
--- a/.github/workflows/linting.yml
+++ b/.github/workflows/linting.yml
@@ -5,6 +5,9 @@ name:                             "Linting"
 on:
   - "push"
 
+permissions:
+  contents:                       "read"
+
 jobs:
   lint:
     name:                         "Linting"
@@ -12,7 +15,7 @@ jobs:
 
     steps:
       - name:                     "Cache Ruby"
-        uses:                     "actions/cache@v3"
+        uses:                     "actions/cache@6f8efc29b200d32929f49075959781ed54ec270c" # v3
         with:
           path:                   "vendor/bundle"
           key:                    |
@@ -21,7 +24,7 @@ jobs:
             ${{ runner.os }}-gems-
 
       - name:                     "Cache NodeJS"
-        uses:                     "actions/cache@v3"
+        uses:                     "actions/cache@6f8efc29b200d32929f49075959781ed54ec270c" # v3
         with:
           path:                   "~/.npm"
           key:                    |
@@ -30,7 +33,7 @@ jobs:
             ${{ runner.os }}-node-
 
       - name:                     "Cache Python"
-        uses:                     "actions/cache@v3"
+        uses:                     "actions/cache@6f8efc29b200d32929f49075959781ed54ec270c" # v3
         with:
           path:                   "~/.cache/pip"
           key:                    |
@@ -39,19 +42,20 @@ jobs:
             ${{ runner.os }}-pip-
 
       - name:                     "Checkout Code"
-        uses:                     "actions/checkout@v3"
+        uses:                     "actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26" # v3
         timeout-minutes:          5
         with:
           fetch-depth:            0
+          persist-credentials:    false
 
       - name:                     "Build Ruby"
-        uses:                     "ruby/setup-ruby@v1"
+        uses:                     "ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b" # v1
         with:
           ruby-version:           3.1
 
       - name:                     "Build Node"
 
-        uses:                     "actions/setup-node@v3"
+        uses:                     "actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610" # v3
         with:
           node-version:           14
 
diff --git a/.github/workflows/locking.yml b/.github/workflows/locking.yml
index 6676dc3..7c1ae38 100644
--- a/.github/workflows/locking.yml
+++ b/.github/workflows/locking.yml
@@ -6,12 +6,17 @@ on:
   workflow_dispatch:                    {}
 
 name:                                   "Issue Locking"
+
+permissions:
+  issues:                               "write"
+  pull-requests:                        "write"
+
 jobs:
   lock-issues:
     runs-on:                            "ubuntu-latest"
     steps:
       - name:                           "Lock Issues"
-        uses:                           "dessant/lock-threads@v4"
+        uses:                           "dessant/lock-threads@be8aa5be94131386884a6da4189effda9b14aa21" # v4
         with:
           github-token:                 "${{ secrets.GITHUB_TOKEN }}"
           issue-lock-inactive-days:     "180"
@@ -29,7 +34,7 @@ jobs:
     runs-on:                            "ubuntu-latest"
     steps:
       - name:                           "Lock Pull Requests"
-        uses:                           "dessant/lock-threads@v4"
+        uses:                           "dessant/lock-threads@be8aa5be94131386884a6da4189effda9b14aa21" # v4
         with:
           github-token:                 "${{ secrets.GITHUB_TOKEN }}"
           pr-lock-inactive-days:        "180"
diff --git a/.github/workflows/testing.yml b/.github/workflows/testing.yml
index 4454e0f..bbf5b0d 100644
--- a/.github/workflows/testing.yml
+++ b/.github/workflows/testing.yml
@@ -6,6 +6,9 @@ on:
   - "push"
   - "pull_request"
 
+permissions:
+  contents:                       "read"
+
 jobs:
   test:
     name:                         "Testing"
@@ -76,13 +79,14 @@ jobs:
 
     steps:
       - name:                     "Checkout Code"
-        uses:                     "actions/checkout@v3"
+        uses:                     "actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26" # v3
         timeout-minutes:          5
         with:
           fetch-depth:            0
+          persist-credentials:    false
 
       - name:                     "Build Ruby"
-        uses:                     "ruby/setup-ruby@v1"
+        uses:                     "ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b" # v1
         with:
           ruby-version:           "${{ matrix.ruby }}"
           bundler:                "${{ matrix.bundler }}"