ci: harden workflows — least-privilege permissions + SHA-pinned actions

2026-05-29 23:47:27 -07:00
parent 4c33cc1f69
commit efa5aced74
6 changed files with 51 additions and 28 deletions
@@ -4,11 +4,17 @@ on:
  schedule:
    - cron: "0 0 * * 1"

+permissions:
+  contents: read
+
 jobs:
  stale:
    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
    steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
        with:
          stale-issue-message: "This issue has been inactive for 30 days. It will be closed in 7 days if no further activity occurs."
          days-before-stale: 30