From 8e033594643f1d6619aa3a04b51318f75c2abd8c Mon Sep 17 00:00:00 2001
From: waterlemonnn <renjiearl06@gmail.com>
Date: Sat, 8 Aug 2026 00:59:11 +0700
Subject: [PATCH] ci: pin actions to commit SHAs and set least privilege
 permissions

actions/checkout, actions/setup-node, and actions/github-script were all
referenced by mutable tag (@v7), so whoever controls those repos could
repoint the tag at different code. contributors.yml runs some of these
jobs from pull_request_target and issue_comment, which have write access
and secrets, so a repointed tag there is a path to repo write.

Pin every uses: to a full commit SHA with the resolved version in a
trailing comment, and add a top level permissions: contents: read to
ci.yml, which had no permissions block at all before this.
---
 .github/workflows/ci.yml           | 19 +++++++++++--------
 .github/workflows/contributors.yml | 12 ++++++------
 .github/workflows/pr-title.yml     |  2 +-
 3 files changed, 18 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 32690d6..760cc7d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,15 +6,18 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   lint-and-typecheck:
     name: Lint & Type Check
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm
@@ -33,9 +36,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm
@@ -51,9 +54,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm
@@ -84,9 +87,9 @@ jobs:
       IP_HASH_PEPPER: placeholder-pepper-32-chars-xxxxxxxxxxxxxxxx
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm
diff --git a/.github/workflows/contributors.yml b/.github/workflows/contributors.yml
index 6144292..47b695d 100644
--- a/.github/workflows/contributors.yml
+++ b/.github/workflows/contributors.yml
@@ -33,7 +33,7 @@ jobs:
       pull-requests: write
       contents: read
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const author = context.payload.pull_request.user.login;
@@ -86,7 +86,7 @@ jobs:
       pull-requests: write
       contents: read
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const author = context.payload.pull_request.user.login;
@@ -145,7 +145,7 @@ jobs:
       issues: write
       contents: read
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const CLAIM_LABEL = "claimed";
@@ -287,7 +287,7 @@ jobs:
       issues: write
       contents: read
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const CLAIM_LABEL = "claimed";
@@ -348,7 +348,7 @@ jobs:
       pull-requests: read
       contents: read
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const CLAIM_LABEL = "claimed";
@@ -436,7 +436,7 @@ jobs:
       pull-requests: read
       contents: read
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const CLAIM_LABEL = "claimed";
diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml
index 0d93787..c84c47c 100644
--- a/.github/workflows/pr-title.yml
+++ b/.github/workflows/pr-title.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Validate PR title
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const title = context.payload.pull_request.title ?? "";