From cb86d760b62da4ff64d72c84d8079dc410d67405 Mon Sep 17 00:00:00 2001
From: Alb3e3 <74142887+Alb3e3@users.noreply.github.com>
Date: Fri, 12 Jun 2026 00:28:59 +0200
Subject: [PATCH] ci: pin action references to full commit SHAs and add
 read-only permissions

Pin all mutable action version tags to their full commit SHAs to prevent
silent tag-rewriting supply-chain attacks. Add `permissions: read-all`
to any workflow that lacked an explicit permissions block.

Verified with zizmor --min-severity high: no findings after this patch.

Signed-off-by: Alb3e3 <tomaska.filip@gmail.com>
---
 .github/workflows/build.yml              | 2 +-
 .github/workflows/riscv64-qemu-test.yaml | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index fc2ad109..054b6b6f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -95,7 +95,7 @@ jobs:
         matrix.optimized && 'RelWithDebInfo' || 'Debug') }}
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       with:
         submodules: true
 
diff --git a/.github/workflows/riscv64-qemu-test.yaml b/.github/workflows/riscv64-qemu-test.yaml
index 3b974805..bb979f44 100644
--- a/.github/workflows/riscv64-qemu-test.yaml
+++ b/.github/workflows/riscv64-qemu-test.yaml
@@ -2,6 +2,8 @@ name: riscv64-qemu-test
 
 on: [push, pull_request]
 
+permissions: read-all
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -11,7 +13,7 @@ jobs:
       RISCV_PATH: /opt/riscv
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         submodules: recursive