Harden GitHub workflows

.github/dependabot.yml

@@ -7,6 +7,8 @@ updates:
           interval: "daily"
 
     # Maintain dependencies for Composer
+      ignore:
+        - dependency-name: "yiisoft/*"
     - package-ecosystem: "composer"
       directory: "/"
       schedule:

.github/workflows/build.yml

@@ -1,3 +1,6 @@
+permissions:
+  contents: read
+
 on:
   - pull_request
   - push
@@ -57,7 +60,7 @@ jobs:
           - 5432:5432
         options: --name=postgres --health-cmd="pg_isready" --health-interval=10s --health-timeout=5s --health-retries=3
       redis:
-        image: redis
+        image: redis:8
         ports:
           - 6379:6379
         options:
@@ -68,15 +71,17 @@ jobs:
 
     steps:
       - name: Install service memcached
-        uses: niden/actions-memcached@v8
+        uses: niden/actions-memcached@9ff2b102979272958682d09bf262563039bea69c
 
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          persist-credentials: false
 
       - name: Setup cache environment 5.3 - 5.6
         if: matrix.php < '7.0'
         id: cache-env-php5
-        uses: shivammathur/cache-extensions@v1
+        uses: shivammathur/cache-extensions@9b476298b44f2e4d4268dd103ff4c3e216314e27
         with:
           php-version: ${{ matrix.php }}
           extensions: ${{ env.extensions-php5 }}
@@ -85,30 +90,30 @@ jobs:
       - name: Setup cache environment 7.0 - 8.0
         if: matrix.php >= '7.0'
         id: cache-env-php7
-        uses: shivammathur/cache-extensions@v1
+        uses: shivammathur/cache-extensions@9b476298b44f2e4d4268dd103ff4c3e216314e27
         with:
           php-version: ${{ matrix.php }}
           extensions: ${{ env.extensions-php7 }}
           key: ${{ env.key-php7 }}
 
       - name: Cache extensions 5.3 - 5.6
         if: matrix.php < '7.0'
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae
         with:
           path: ${{ steps.cache-env-php5.outputs.dir }}
           key: ${{ steps.cache-env-php5.outputs.key }}
           restore-keys: ${{ steps.cache-env-php5.outputs.key }}
 
       - name: Cache extensions 7.0 - 8.0
         if: matrix.php >= '7.0'
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae
         with:
           path: ${{ steps.cache-env-php7.outputs.dir }}
           key: ${{ steps.cache-env-php7.outputs.key }}
           restore-keys: ${{ steps.cache-env-php7.outputs.key }}
 
       - name: Install PHP with extensions
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45
         with:
           php-version: ${{ matrix.php }}
           extensions: ${{ env.extensions }}
@@ -125,7 +130,7 @@ jobs:
         run: echo "COMPOSER_CACHE_DIR=~\AppData\Local\Composer" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
 
       - name: Cache dependencies installed with composer
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae
         with:
           path: ${{ env.COMPOSER_CACHE_DIR }}
           key: php${{ matrix.php }}-composer-${{ hashFiles('**/composer.json') }}