From 409b440d0199ed7dd072699969dd6b798707933b Mon Sep 17 00:00:00 2001
From: Mark Stuart <mstuart@users.noreply.github.com>
Date: Sat, 22 Aug 2026 22:14:11 -0700
Subject: [PATCH] ci: harden GitHub Actions workflows

---
 .github/workflows/main.yml           | 8 ++++++--
 .github/workflows/release.yml        | 4 ++--
 .github/workflows/security-audit.yml | 4 ++--
 3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 8222449..cabad5c 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -2,6 +2,10 @@ name: CI
 on:
   - push
   - pull_request
+
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Node.js ${{ matrix.node-version }}
@@ -13,8 +17,8 @@ jobs:
           - 24
           - 22
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: ${{ matrix.node-version }}
       - run: npm install
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4b1e148..9bdf187 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,8 +25,8 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: 22
           registry-url: "https://registry.npmjs.org"
diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml
index b218b03..cb47cef 100644
--- a/.github/workflows/security-audit.yml
+++ b/.github/workflows/security-audit.yml
@@ -26,8 +26,8 @@ jobs:
   audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: 22
       # Some repos intentionally ship without a committed lockfile; `npm ci`