ci: add permissions and pin action SHAs (22 workflows)

.github/workflows/aarch64_linux_bazel.yml

@@ -7,13 +7,15 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions: read-all
+
 jobs:
   # Building using the GitHub runner environement directly.
   bazel:
     runs-on: ubuntu-24.04-arm
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
       - name: Build
         run: make --directory=bazel/ci arm64_build
       - name: Test

.github/workflows/aarch64_linux_cmake.yml

@@ -7,6 +7,8 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions: read-all
+
 jobs:
   # Building using the github runner environement directly.
   make:
@@ -21,7 +23,7 @@ jobs:
     env:
       TARGET: ${{ matrix.targets[0] }}
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
     - name: Build
       run: make --directory=cmake/ci ${TARGET}_build
     - name: Test

.github/workflows/aarch64_linux_zig.yml

@@ -2,6 +2,8 @@ name: aarch64 Linux Zig
 
 on: [push, pull_request]
 
+permissions: read-all
+
 jobs:
   run:
     strategy:
@@ -11,8 +13,8 @@ jobs:
           - aarch64-linux-gnu
     runs-on: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@v6
-      - uses: mlugg/setup-zig@v2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+      - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29  # v2
         with:
           version: 0.16.0
       - name: Build

.github/workflows/amd64_linux_bazel.yml

@@ -7,15 +7,17 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions: read-all
+
 jobs:
   # Building using the github runner environement directly.
   bazel:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3  # v4
       - name: Check docker
         run: |
           docker info

.github/workflows/amd64_linux_cmake.yml

@@ -7,12 +7,14 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions: read-all
+
 jobs:
   # Building using the github runner environement directly.
   make:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
     - name: Env
       run: make --directory=cmake/ci amd64_env
     - name: Devel

.github/workflows/amd64_linux_zig.yml

@@ -2,6 +2,8 @@ name: amd64 Linux Zig
 
 on: [push, pull_request]
 
+permissions: read-all
+
 jobs:
   run:
     strategy:
@@ -11,8 +13,8 @@ jobs:
           - x86_64-linux-gnu
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: mlugg/setup-zig@v2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+      - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29  # v2
         with:
           version: 0.16.0
       - name: Build

.github/workflows/amd64_macos_bazel.yml

@@ -8,13 +8,15 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions: read-all
+
 jobs:
   # Building using the github runner environement directly.
   bazel:
     runs-on: macos-15-intel  # Using x86 processors
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
       - name: Install Bazel
         run: |
           brew update

.github/workflows/amd64_macos_cmake.yml

@@ -8,14 +8,16 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions: read-all
+
 jobs:
   # Building using the github runner environement directly.
   xcode:
     runs-on: macos-15-intel  # Using x86 processors
     env:
       CTEST_OUTPUT_ON_FAILURE: 1
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
     - name: Check cmake
       run: cmake --version
     - name: Configure
@@ -31,7 +33,7 @@ jobs:
     env:
       CTEST_OUTPUT_ON_FAILURE: 1
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
     - name: Check cmake
       run: cmake --version
     - name: Configure

.github/workflows/amd64_macos_zig.yml

@@ -2,6 +2,8 @@ name: amd64 MacOS Zig
 
 on: [push, pull_request]
 
+permissions: read-all
+
 jobs:
   run:
     strategy:
@@ -10,8 +12,8 @@ jobs:
           - x86_64-macos-none
     runs-on: macos-15-intel  # Using x86 processors
     steps:
-      - uses: actions/checkout@v6
-      - uses: mlugg/setup-zig@v2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+      - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29  # v2
         with:
           version: 0.16.0
       - name: Build

.github/workflows/amd64_windows_bazel.yml

@@ -8,13 +8,15 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions: read-all
+
 jobs:
   # Building using the github runner environement directly.
   bazel:
     runs-on: windows-latest
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
       - name: Install Bazel
         run: |
           choco install bazel

.github/workflows/amd64_windows_cmake.yml

@@ -7,14 +7,16 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions: read-all
+
 jobs:
   # Building using the github runner environement directly.
   msvc:
     runs-on: windows-latest
     env:
       CTEST_OUTPUT_ON_FAILURE: 1
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
     - name: Configure
       run: cmake -S. -Bbuild -G "Visual Studio 17 2022" -DCMAKE_CONFIGURATION_TYPES=Release
     - name: Build

.github/workflows/amd64_windows_zig.yml

@@ -2,6 +2,8 @@ name: amd64 Windows Zig
 
 on: [push, pull_request]
 
+permissions: read-all
+
 jobs:
   run:
     strategy:
@@ -10,8 +12,8 @@ jobs:
           - x86_64-windows-gnu
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: mlugg/setup-zig@v2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+      - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29  # v2
         with:
           version: 0.16.0
       - name: Build

.github/workflows/arm64_macos_bazel.yml

@@ -8,13 +8,15 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions: read-all
+
 jobs:
   # Building using the github runner environement directly.
   bazel:
     runs-on: macos-latest # Using M1 processors, ref: https://github.com/actions/runner-images
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
       - name: Install Bazel
         run: |
           brew update

.github/workflows/arm64_macos_cmake.yml

@@ -8,14 +8,16 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions: read-all
+
 jobs:
   # Building using the github runner environement directly.
   xcode:
     runs-on: macos-latest # Using M1 processors, ref: https://github.com/actions/runner-images
     env:
       CTEST_OUTPUT_ON_FAILURE: 1
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
     - name: Check cmake
       run: cmake --version
     - name: Configure
@@ -31,7 +33,7 @@ jobs:
     env:
       CTEST_OUTPUT_ON_FAILURE: 1
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
     - name: Check cmake
       run: cmake --version
     - name: Configure

.github/workflows/arm64_macos_zig.yml

@@ -2,6 +2,8 @@ name: Arm64 MacOS Zig
 
 on: [push, pull_request]
 
+permissions: read-all
+
 jobs:
   run:
     strategy:
@@ -10,8 +12,8 @@ jobs:
           - aarch64-macos-none
     runs-on: macos-latest  # Using M1 processors
     steps:
-      - uses: actions/checkout@v6
-      - uses: mlugg/setup-zig@v2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+      - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29  # v2
         with:
           version: 0.16.0
       - name: Build

.github/workflows/arm_linux_cmake.yml

@@ -7,6 +7,8 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions: read-all
+
 jobs:
   # Building using the github runner environement directly.
   make:
@@ -21,7 +23,7 @@ jobs:
     env:
       TARGET: ${{ matrix.targets[0] }}
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
     - name: Build
       run: make --directory=cmake/ci ${TARGET}_build
     - name: Test

.github/workflows/clang_format.yml

@@ -2,12 +2,14 @@ name: clang-format Check
 
 on: [push, pull_request]
 
+permissions: read-all
+
 jobs:
   # Building using the github runner environement directly.
   clang-format:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
     - name: Fetch origin/main
       run: git fetch origin main
     - name: List of changed file(s)

.github/workflows/mips_linux_cmake.yml

@@ -7,6 +7,8 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions: read-all
+
 jobs:
   # Building using the github runner environement directly.
   make:
@@ -23,7 +25,7 @@ jobs:
     env:
       TARGET: ${{ matrix.targets[0] }}
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
     - name: Build
       run: make --directory=cmake/ci ${TARGET}_build
     - name: Test

.github/workflows/power_linux_cmake.yml

@@ -7,6 +7,8 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions: read-all
+
 jobs:
   # Building using the github runner environement directly.
   make:
@@ -22,7 +24,7 @@ jobs:
     env:
       TARGET: ${{ matrix.targets[0] }}
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
     - name: Build
       run: make --directory=cmake/ci ${TARGET}_build
     - name: Test

.github/workflows/riscv_linux_cmake.yml

@@ -7,6 +7,8 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions: read-all
+
 jobs:
   # Building using the github runner environement directly.
   make:
@@ -21,7 +23,7 @@ jobs:
     env:
       TARGET: ${{ matrix.targets[0] }}
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
     - name: Build
       run: make --directory=cmake/ci ${TARGET}_build
     - name: Test

.github/workflows/s390x_linux_cmake.yml

@@ -7,6 +7,8 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions: read-all
+
 jobs:
   # Building using the github runner environement directly.
   make:
@@ -20,7 +22,7 @@ jobs:
     env:
       TARGET: ${{ matrix.targets[0] }}
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
     - name: Build
       run: make --directory=cmake/ci ${TARGET}_build
     - name: Test