Summary

Problem description and solution.
This pull request strengthens the security of our GitHub Actions workflows by hardening the runners and pinning action versions to specific commit SHAs. It also adds explicit permissions for the coverage workflow.

Detail

Changeset

Security hardening of GitHub Actions workflows:

• Added the step-security/harden-runner action to both the lint_and_test and run_coverage jobs to audit or block outbound calls, reducing the risk of supply chain attacks. [1] [2]
• In the run_coverage job, configured the harden-runner action to block egress except for globally allowed endpoints, and added explicit id-token: write permissions for improved security and least-privilege operation.

Workflow maintenance and reliability:

• Updated the actions/checkout action in both workflows to use a specific commit SHA rather than a version tag, ensuring builds are deterministic and protected from upstream changes. [1] [2]

Checklist

• Did you add new tests and confirm all tests pass? (yarn test)
• Did you ensure any new Solidity source code files meet minimum test coverage requirements? (yarn coverage)
• Did you update relevant docs? (docs are found in the docs folder)
• Do your commits follow the Conventional Commits standard?
• Does your PR title also follow the Conventional Commits standard?
• Did you run lint (yarn lint) and fix any issues?
• Did you run formatter (yarn format:check) and fix any issues (yarn format:write)?

Testing

Tested using the PR workflows.

Documentation

Optional section.
Link to the doc.