From 1a91d8b37048f6b1026c6813b0f38daef5337968 Mon Sep 17 00:00:00 2001
From: Oskar Eichler <oskar@songstats.com>
Date: Thu, 3 Sep 2026 21:27:33 +0700
Subject: [PATCH] Pin CI actions and restrict permissions

---
 .github/workflows/ci.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c5e9e56..78f8a50 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,5 +1,7 @@
 name: CI
 on: [push, pull_request]
+permissions:
+  contents: read
 jobs:
   test:
     strategy:
@@ -24,8 +26,8 @@ jobs:
     env:
       CHILDPROCESS_UNSET: should-be-unset
     steps:
-    - uses: actions/checkout@v2
-    - uses: ruby/setup-ruby@v1
+    - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
+    - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1
       with:
         ruby-version: ${{ matrix.ruby }}
         bundler-cache: true