[CI] Pin actions to commit SHAs and scope workflow permissions

Author: Kocal

.github/dependabot.yml

@@ -0,0 +1,42 @@
+# https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference
+
+version: 2
+updates:
+    # GitHub Actions
+    - package-ecosystem: 'github-actions'
+      directory: '/'
+      schedule:
+          interval: 'weekly'
+      groups:
+          github-actions:
+              patterns:
+                  - '*'
+      cooldown:
+          default-days: 7
+
+    # npm, but only Reprise's internal dev/build tooling. The runtime dependency
+    # (unplugin) and the peer dependencies (vite, @rsbuild/core, @hotwired/stimulus)
+    # are semver-meaningful for consumers and bumped by hand, so they are excluded.
+    - package-ecosystem: 'npm'
+      directories:
+          - '/'
+          - '/assets'
+      schedule:
+          interval: 'weekly'
+      allow:
+          - dependency-name: '@antfu/eslint-config'
+          - dependency-name: 'eslint'
+          - dependency-name: '@rspack/core'
+          - dependency-name: '@types/node'
+          - dependency-name: 'jsdom'
+          - dependency-name: 'nodemon'
+          - dependency-name: 'tsdown'
+          - dependency-name: 'tsx'
+          - dependency-name: 'typescript'
+          - dependency-name: 'vitest'
+      groups:
+          npm-dev-dependencies:
+              patterns:
+                  - '*'
+      cooldown:
+          default-days: 7

.github/workflows/ci.yml

@@ -9,18 +9,25 @@ on:
     branches:
       - main
 
+# Cancel any in-progress run for the same ref (branch/PR) when a new commit is pushed.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   lint:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       - name: Set node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: .nvmrc
           cache: pnpm
@@ -32,15 +39,19 @@ jobs:
 
   test:
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       - name: Set node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: .nvmrc
           cache: pnpm
@@ -55,6 +66,8 @@ jobs:
   php:
     name: PHP ${{ matrix.php-version }} + Symfony ${{ matrix.symfony-version }}${{ matrix.dependency-version == 'lowest' && ' lowest' || '' }} on ${{ matrix.os || 'ubuntu-latest' }}
     runs-on: ${{ matrix.os || 'ubuntu-latest' }}
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -82,14 +95,16 @@ jobs:
       # symfony/* package to this version during the Composer resolution.
       SYMFONY_REQUIRE: ${{ matrix.symfony-version }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: ${{ matrix.php-version }}
           tools: flex
       - name: Install dependencies
-        uses: ramsey/composer-install@v3
+        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
         with:
           dependency-versions: ${{ matrix.dependency-version == 'lowest' && 'lowest' || 'highest' }}
           composer-options: --prefer-dist
@@ -99,17 +114,21 @@ jobs:
 
   php-qa:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.4'
           tools: composer:v2
       - name: Validate composer.json
         run: composer validate --strict
       - name: Install dependencies
-        uses: ramsey/composer-install@v3
+        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
         with:
           dependency-versions: highest
           composer-options: --prefer-dist