From f1f28e5fe47c76e2d75bff85d3846f33fa180f92 Mon Sep 17 00:00:00 2001
From: Veselin Stoyanov <veselin.stoyanov@ly.st>
Date: Thu, 12 Nov 2026 18:00:20 +0200
Subject: [PATCH] Pin GitHub Actions to commit SHAs

Pin actions/checkout and actions/setup-node to full commit SHAs in the
publish and CI workflows, restrict the default GITHUB_TOKEN to read-only,
stop persisting checkout credentials, and add Dependabot for action updates.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/dependabot.yml        | 6 ++++++
 .github/workflows/node.js.yml | 9 +++++++--
 .github/workflows/publish.yml | 9 +++++++--
 3 files changed, 20 insertions(+), 4 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..3a626c3
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
diff --git a/.github/workflows/node.js.yml b/.github/workflows/node.js.yml
index d4d973a..fd03d78 100644
--- a/.github/workflows/node.js.yml
+++ b/.github/workflows/node.js.yml
@@ -9,6 +9,9 @@ on:
   pull_request:
     branches: [master]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -19,9 +22,11 @@ jobs:
         # See supported Node.js release schedule at https://nodejs.org/en/about/releases/
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+        with:
+          persist-credentials: false
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: ${{ matrix.node-version }}
           cache: "npm"
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 17bc655..fe68a24 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -4,13 +4,18 @@ on:
   push:
     branches: [master]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+        with:
+          persist-credentials: false
       # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: '18.x'
           registry-url: 'https://registry.npmjs.org'