ci(security): SHA-pin all actions (deploy + CodeQL)

.github/workflows/codeql-analysis.yml

@@ -39,11 +39,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v2
+      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
+      uses: github/codeql-action/init@dd903d2e4f5405488e5ef1422510ee31c8b32357  # v3
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -54,7 +54,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
+      uses: github/codeql-action/autobuild@dd903d2e4f5405488e5ef1422510ee31c8b32357  # v3
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -68,4 +68,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      uses: github/codeql-action/analyze@dd903d2e4f5405488e5ef1422510ee31c8b32357  # v3

.github/workflows/dev.yml

@@ -8,6 +8,10 @@ on:
   pull_request:
     branches-ignore: [ master ]
 
+# GITHUB_TOKEN is read-only; the deploy authenticates to Cloudflare via CF_API_TOKEN.
+permissions:
+  contents: read
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   # This workflow contains a single job called "build"
@@ -17,13 +21,13 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@master
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5
         with:
           submodules: true  # (true OR recursive)
           fetch-depth: 0    # Fetch all history for .GitInfo and .Lastmod
       # deploy to cloudflare worker
       - name: Deploy
-        uses: cloudflare/wrangler-action@1.2.0
+        uses: cloudflare/wrangler-action@21f14faa062c33c938e3f37c30d52021bed521cb  # 1.2.0
         env:
           USER: root
           CF_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}

.github/workflows/main.yml

@@ -8,6 +8,10 @@ on:
   pull_request:
     branches: [ master ]
 
+# GITHUB_TOKEN is read-only; the deploy authenticates to Cloudflare via CF_API_TOKEN.
+permissions:
+  contents: read
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   # This workflow contains a single job called "build"
@@ -17,13 +21,13 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@master
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5
         with:
           submodules: true  # (true OR recursive)
           fetch-depth: 0    # Fetch all history for .GitInfo and .Lastmod
       # deploy to cloudflare worker
       - name: Deploy
-        uses: cloudflare/wrangler-action@1.2.0
+        uses: cloudflare/wrangler-action@21f14faa062c33c938e3f37c30d52021bed521cb  # 1.2.0
         env:
           USER: root
           CF_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}