Bump & pin actions

Author: BehnH

.github/actions/benchmarks/action.yml

@@ -14,7 +14,7 @@ runs:
 
     - name: Upload Results
       if: steps.benchmarks.outcome == 'success'
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: Benchmarks-${{ steps.go-version.outputs.version }}
         path: benchmarks.txt

.github/actions/coverage/action.yml

@@ -23,7 +23,7 @@ runs:
         echo "coverage_status=$status" >> $GITHUB_OUTPUT
 
     - name: Upload coverage results
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: Coverage-result-${{ steps.go-version.outputs.version }}
         path: build/coverage*

.github/actions/unit-tests/action.yml

@@ -29,7 +29,7 @@ runs:
 
     - name: Upload test results
       if: steps.process-test.outcome == 'success'
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: Test-result-${{ steps.go-version.outputs.version }}
         path: junit_report.xml

.github/workflows/ci.yml

@@ -9,6 +9,9 @@ on:
     paths-ignore:
       - '**.md'
 
+permissions:
+  contents: read
+
 jobs:
   go-versions:
     uses: ./.github/workflows/go-versions.yml
@@ -35,9 +38,11 @@ jobs:
       matrix:
         go-version: ${{ fromJSON(needs.go-versions.outputs.matrix) }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: 'false'
       - name: Setup Go ${{ matrix.go-version }}
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ matrix.go-version }}
       - name: Test

.github/workflows/common_ci.yml

@@ -12,9 +12,11 @@ jobs:
     runs-on: ubuntu-latest
     name: 'Unit Tests and Coverage'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: 'false'
       - name: Setup Go ${{ inputs.go-version }}
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version }}
       - uses: ./.github/actions/unit-tests
@@ -28,9 +30,11 @@ jobs:
     name: 'Benchmarks'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: 'false'
       - name: Setup Go ${{ inputs.go-version }}
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version }}
       - uses: ./.github/actions/benchmarks

.github/workflows/go-versions.yml

@@ -42,7 +42,9 @@ jobs:
       penultimate: ${{ steps.set-env.outputs.penultimate }}
       all: ${{ steps.set-matrix.outputs.all }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: 'false'
       - name: Set Go Versions
         id: set-env
         run: cat ./.github/variables/go-versions.env > $GITHUB_OUTPUT

.github/workflows/release-please.yml

@@ -6,8 +6,14 @@ on:
       - main
   workflow_dispatch:
 
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
 jobs:
   release-please:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     steps:
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0

.github/workflows/stale.yml

@@ -5,6 +5,12 @@ on:
     # Happen once per day at 1:30 AM
     - cron: '30 1 * * *'
 
+permissions:
+  actions: write
+  contents: read
+  issues: write
+  pull-requests: write
+
 jobs:
   sdk-close-stale:
     uses: launchdarkly/gh-actions/.github/workflows/sdk-stale.yml@main