zizmor (#39)

Author: korniltsev

.github/workflows/ci.yaml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     runs-on: ubuntu-latest
@@ -16,8 +19,10 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v2
+        with:
+          persist-credentials: 'false'
       - name: asdf_install
-        uses: asdf-vm/actions/install@v3.0.2
+        uses: asdf-vm/actions/install@05e0d2ed97b598bfce82fd30daf324ae0c4570e6 # v3.0.2
       - run: make install-dev-tools
       # Make asdf aware of globally installed binaries
       - run: asdf reshim
@@ -34,6 +39,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v2
+        with:
+          persist-credentials: 'false'
       - name: asdf_install
-        uses: asdf-vm/actions/install@v3.0.2
+        uses: asdf-vm/actions/install@05e0d2ed97b598bfce82fd30daf324ae0c4570e6 # v3.0.2
       - run: make shellcheck

.github/workflows/release-please.yml

@@ -3,12 +3,15 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 name: release-please
 jobs:
   release-please:
     runs-on: ubuntu-latest
     steps:
-      - uses: google-github-actions/release-please-action@v3
+      - uses: googleapis/release-please-action@a02a34c4d625f9be7cb89156071d8567266a2445 # v4.2.0
         with:
           release-type: go
           package-name: pyroscope-lambda-extension

.github/workflows/release.yaml

@@ -14,13 +14,18 @@ on:
 #      tag_name:
 #        type: string
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
+        with:
+          persist-credentials: 'false'
       - name: asdf_install
-        uses: asdf-vm/actions/install@v3.0.2
+        uses: asdf-vm/actions/install@05e0d2ed97b598bfce82fd30daf324ae0c4570e6 # v3.0.2
       - run: make clean
       - run: make build-amd
       - run: make build-arm
@@ -34,15 +39,15 @@ jobs:
       # use tag_name if available (ie manual invokation)
       - if: ${{ inputs.tag_name == '' }}
         id: update_release_auto
-        uses: tubone24/update_release@v1.3.1
+        uses: tubone24/update_release@c04c17054b939144ec8a7cba969d74992f812d66 # v1.3.1
         env:
           GITHUB_TOKEN: ${{ github.token }}
         with:
           body_path: release.tmp.md
           is_append_body: true
       - if: ${{ inputs.tag_name != '' }}
         id: update_release_manual
-        uses: tubone24/update_release@v1.3.1
+        uses: tubone24/update_release@c04c17054b939144ec8a7cba969d74992f812d66 # v1.3.1
         env:
           GITHUB_TOKEN: ${{ github.token }}
           TAG_NAME: ${{ inputs.tag_name }}