ci: pin dependencies and explicit permissions in the pipeline

Author: UlisesGascon

.github/workflows/ci.yml

@@ -11,6 +11,9 @@ on:
     branches:
       - '*'
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
@@ -23,8 +26,8 @@ jobs:
         node-version: [18.x, 20.x]
 
     steps:
-    - uses: actions/checkout@v2
-    - uses: actions/[email protected]
+    - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
+    - uses: actions/setup-node@c46424eee26de4078d34105d3de3cc4992202b1e # v2.1.4
       with:
         node-version: ${{ matrix.node-version }}
     - run: npm ci