From 481adcb1f84200b34a88a9e0c97aa1c9dd3826c5 Mon Sep 17 00:00:00 2001
From: Konstantinos Paparas <kelsos86@gmail.com>
Date: Fri, 3 Jul 2026 14:14:58 +0200
Subject: [PATCH] Harden and pin GitHub Actions

- Pin all actions to full commit SHAs (checkout v7, setup-python v6.3, cache v6.1)
- Set persist-credentials: false on checkout
- Restrict GITHUB_TOKEN with top-level permissions: {} and contents: read on the job
- Add timeout-minutes to bound runaway jobs

Passes zizmor with no findings.
---
 .github/workflows/verify.yml | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index d66c702..55fb4b2 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -2,13 +2,20 @@ name: verify
 
 on: [push, pull_request]
 
+permissions: {}
+
 jobs:
   verify-files:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
     - name: Set up python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
       with:
         python-version: '3.13'
     - name: Install dependencies
@@ -16,10 +23,10 @@ jobs:
         python3 -m pip install --upgrade pip setuptools wheel
         pip3 install -r requirements.txt
     - name: Store python cache
-      uses: actions/cache@v4
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.cache/pip
         key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }}
     - name: Verify changes
       run: |
-        pytest tests
\ No newline at end of file
+        pytest tests