[LOW] Pin workflow actions and restrict token permissions

.github/workflows/labels.yml

@@ -6,19 +6,25 @@ on:
   - "workflow_dispatch"
 
 name:                             "Labels"
+
+permissions:
+  contents:                       "read"
+  issues:                         "write"
+
 jobs:
   synchronize-labels:
     name:                         "Synchronize Labels"
     runs-on:                      "ubuntu-latest"
     steps:
       - name:                     "Checkout Code"
-        uses:                     "actions/checkout@v3"
+        uses:                     "actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26" # v3
         timeout-minutes:          5
         with:
           fetch-depth:            0
+          persist-credentials:    false
 
       - name:                     "Synchronize Labels"
-        uses:                     "micnncim/action-label-syncer@v1"
+        uses:                     "micnncim/action-label-syncer@3abd5ab72fda571e69fffd97bd4e0033dd5f495c" # v1
         with:
           manifest:               ".github/labels.yml"
         env:

.github/workflows/linting.yml

@@ -5,14 +5,17 @@ name:                             "Linting"
 on:
   - "push"
 
+permissions:
+  contents:                       "read"
+
 jobs:
   lint:
     name:                         "Linting"
     runs-on:                      "ubuntu-latest"
 
     steps:
       - name:                     "Cache Ruby"
-        uses:                     "actions/cache@v3"
+        uses:                     "actions/cache@6f8efc29b200d32929f49075959781ed54ec270c" # v3
         with:
           path:                   "vendor/bundle"
           key:                    |
@@ -21,7 +24,7 @@ jobs:
             ${{ runner.os }}-gems-
 
       - name:                     "Cache NodeJS"
-        uses:                     "actions/cache@v3"
+        uses:                     "actions/cache@6f8efc29b200d32929f49075959781ed54ec270c" # v3
         with:
           path:                   "~/.npm"
           key:                    |
@@ -30,7 +33,7 @@ jobs:
             ${{ runner.os }}-node-
 
       - name:                     "Cache Python"
-        uses:                     "actions/cache@v3"
+        uses:                     "actions/cache@6f8efc29b200d32929f49075959781ed54ec270c" # v3
         with:
           path:                   "~/.cache/pip"
           key:                    |
@@ -39,19 +42,20 @@ jobs:
             ${{ runner.os }}-pip-
 
       - name:                     "Checkout Code"
-        uses:                     "actions/checkout@v3"
+        uses:                     "actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26" # v3
         timeout-minutes:          5
         with:
           fetch-depth:            0
+          persist-credentials:    false
 
       - name:                     "Build Ruby"
-        uses:                     "ruby/setup-ruby@v1"
+        uses:                     "ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b" # v1
         with:
           ruby-version:           3.1
 
       - name:                     "Build Node"
 
-        uses:                     "actions/setup-node@v3"
+        uses:                     "actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610" # v3
         with:
           node-version:           14
 

.github/workflows/locking.yml

@@ -6,12 +6,17 @@ on:
   workflow_dispatch:                    {}
 
 name:                                   "Issue Locking"
+
+permissions:
+  issues:                               "write"
+  pull-requests:                        "write"
+
 jobs:
   lock-issues:
     runs-on:                            "ubuntu-latest"
     steps:
       - name:                           "Lock Issues"
-        uses:                           "dessant/lock-threads@v4"
+        uses:                           "dessant/lock-threads@be8aa5be94131386884a6da4189effda9b14aa21" # v4
         with:
           github-token:                 "${{ secrets.GITHUB_TOKEN }}"
           issue-lock-inactive-days:     "180"
@@ -29,7 +34,7 @@ jobs:
     runs-on:                            "ubuntu-latest"
     steps:
       - name:                           "Lock Pull Requests"
-        uses:                           "dessant/lock-threads@v4"
+        uses:                           "dessant/lock-threads@be8aa5be94131386884a6da4189effda9b14aa21" # v4
         with:
           github-token:                 "${{ secrets.GITHUB_TOKEN }}"
           pr-lock-inactive-days:        "180"

.github/workflows/testing.yml

@@ -6,6 +6,9 @@ on:
   - "push"
   - "pull_request"
 
+permissions:
+  contents:                       "read"
+
 jobs:
   test:
     name:                         "Testing"
@@ -76,13 +79,14 @@ jobs:
 
     steps:
       - name:                     "Checkout Code"
-        uses:                     "actions/checkout@v3"
+        uses:                     "actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26" # v3
         timeout-minutes:          5
         with:
           fetch-depth:            0
+          persist-credentials:    false
 
       - name:                     "Build Ruby"
-        uses:                     "ruby/setup-ruby@v1"
+        uses:                     "ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b" # v1
         with:
           ruby-version:           "${{ matrix.ruby }}"
           bundler:                "${{ matrix.bundler }}"