Pin actions and explicitly set permissions

github · Dec 23, 2024 · 7c48cd8 · 7c48cd8
1 parent 8a57655
commit 7c48cd8
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/.github/workflows/cibuild.yaml b/.github/workflows/cibuild.yaml
@@ -1,5 +1,9 @@
 on: push
 name: cibuild
+
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Test
@@ -10,7 +14,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@540484a3c0f308b08619664ec40bf6c371d172c3 # v1.205.0
         with:
           ruby-version: ${{ matrix.ruby }}
       - name: script/cibuild

diff --git a/.github/workflows/pages-gem.yml b/.github/workflows/pages-gem.yml
@@ -4,14 +4,17 @@ on:
   release:
     types: [released]
 
+permissions:
+  contents: read
+
 jobs:
   release:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Setup Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@540484a3c0f308b08619664ec40bf6c371d172c3 # v1.205.0
         with:
           ruby-version: "3.3"
       - name: Build gem