security: pin dependencies and restrict token permissions

[djach7]

Pin all GitHub Actions to commit SHAs and container images to digests
to prevent supply chain attacks. Add explicit permissions blocks to
workflows following principle of least privilege.

Changes:

• Pin actions/checkout, actions/setup-go, codecov/codecov-action, actions/create-github-app-token, cycjimmy/semantic-release-action, goreleaser/goreleaser-action, and github/codeql-action to commit SHAs
• Pin quay.io/fedora/fedora container image to sha256 digest
• Add workflow-level "contents: read" permission to ci.yml and security.yml
• Add job-level "contents: write" permission to version-release job

These changes address OpenSSF Scorecard findings:

• Pinned-Dependencies: 0/10 -> 10/10
• Token-Permissions: 0/10 -> 10/10
• Expected overall score improvement: 6.8/10 -> ~8.0/10

Related: THEEDGE-4717

Co-Authored-By: Claude Sonnet 4.5 noreply@anthropic.com

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.37%. Comparing base (3a306a0) to head (7ed4b1b).

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #90      +/-   ##
==========================================
+ Coverage   79.19%   79.37%   +0.17%     
==========================================
  Files          10       10              
  Lines        1115     1115              
==========================================
+ Hits          883      885       +2     
+ Misses        134      133       -1     
+ Partials       98       97       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[miabbott]

I don't disagree with the pinning of the actions, but I just want to understand how we would handle updating them in the future.

Dependabot has made this easier in the past with their auto-generated PRs; can the behavior of dependabot be changed to use digests instead of tags?

[djach7]

Sorry @miabbott I missed this comment. From my understanding (and what I've learned grilling claude about this) dependabot should maintain whatever format is in the file. So after this PR is merged all future dependabot PRs should switch to using digests as well.

[knecasov]

I added a few comments.

[djach7]

@knecasov thanks for reviewing! I just pushed an update addressing your comments and I resolved the ones that were comment or hash updates. I left the digest one open in case we want to have more discussion there.

[knecasov]

@knecasov thanks for reviewing! I just pushed an update addressing your comments and I resolved the ones that were comment or hash updates. I left the digest one open in case we want to have more discussion there.

Thank you very much, @djach7! I added some comments.

[knecasov]

LGTM! Thank you very much for incorporating comments and the discussion.

[pcdubs]

LGTM