ci: pin actions to commit SHAs and run workflows with read-only tokens

.github/workflows/close_inactive_issues_prs.yaml

@@ -11,7 +11,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           operations-per-run: 500 # API rate limit

.github/workflows/lint.yaml

@@ -1,4 +1,6 @@
 name: Lint
+permissions:
+  contents: read
 on:
   push:
     branches:
@@ -14,16 +16,19 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-python@v5
-    # enforce the same check as pre-commit
-    # but only run important checks
-    - uses: pre-commit/action@v3.0.1
-      with:
-        extra_args: codespell --all-files
-    - uses: pre-commit/action@v3.0.1
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       with:
-        extra_args: ruff --all-files
-    - uses: pre-commit/action@v3.0.1
+        persist-credentials: false
+    - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+    # enforce the same check as pre-commit
+    # but only run important checks.
+    # These steps are what pre-commit/action does, written out so that every
+    # action is pinned by SHA (pre-commit/action calls actions/cache by tag).
+    - run: python -m pip install pre-commit==4.7.0
+    - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
-        extra_args: ruff-format --all-files
+        path: ~/.cache/pre-commit
+        key: pre-commit-3|${{ env.pythonLocation }}|${{ hashFiles('.pre-commit-config.yaml') }}
+    - run: pre-commit run --show-diff-on-failure --color=always codespell --all-files
+    - run: pre-commit run --show-diff-on-failure --color=always ruff --all-files
+    - run: pre-commit run --show-diff-on-failure --color=always ruff-format --all-files

.github/workflows/test.yaml

@@ -1,5 +1,8 @@
 name: Test
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
@@ -40,10 +43,12 @@ jobs:
         mysql-image: ["datajoint/mysql:8.0", "mysql:8.4"]
     name: test (${{ matrix.environment }}, mysql=${{ matrix.mysql-image }})
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
 
       - name: Set up pixi
-        uses: prefix-dev/setup-pixi@v0.9.3
+        uses: prefix-dev/setup-pixi@82d477f15f3a381dbcc8adc1206ce643fe110fb7 # v0.9.3
         with:
           cache: true
           locked: false
@@ -58,10 +63,12 @@ jobs:
   unit-tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
 
       - name: Set up pixi
-        uses: prefix-dev/setup-pixi@v0.9.3
+        uses: prefix-dev/setup-pixi@82d477f15f3a381dbcc8adc1206ce643fe110fb7 # v0.9.3
         with:
           cache: true
           locked: false
@@ -84,12 +91,13 @@ jobs:
         python-version: ["3.10", "3.14", "3.15"]
     name: unit-tests-windows (py${{ matrix.python-version }})
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0 # hatch-vcs derives the version from git history/tags
+          persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: ${{ matrix.python-version }}