ci: declare explicit workflow permissions and pin actions to commit SHAs

.github/workflows/continuous_integration.yml

@@ -2,6 +2,9 @@ name: Continuous Integration
 
 on: [pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
@@ -11,9 +14,9 @@ jobs:
         python-version: [3.9]
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Set up Python
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
       with:
         python-version: ${{ matrix.python-version }}
 
@@ -65,11 +68,11 @@ jobs:
       if: always()
 
     - name: Upload pytest test results
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: notebook-test-results
         path: examples/junit/notebook-test-results.xml
 
     - name: Download all workflow run artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       if: always()

.github/workflows/publish.yml

@@ -5,20 +5,25 @@ on:
   push:
     branches: main
 
+# Workflow-level default is read-only so any job added later starts least-privileged.
+# The one job that needs to push is granted write explicitly below.
+permissions:
+  contents: read
+
 jobs:
   build-deploy:
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: write   # quarto publish pushes the rendered site to gh-pages
     steps:
       - name: Check out repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Set up Quarto
-        uses: quarto-dev/quarto-actions/setup@v2
+        uses: quarto-dev/quarto-actions/setup@8a96df13519ee81fd526f2dfca5962811136661b # v2
 
       - name: Render and Publish
-        uses: quarto-dev/quarto-actions/publish@v2
+        uses: quarto-dev/quarto-actions/publish@8a96df13519ee81fd526f2dfca5962811136661b # v2
         with:
           target: gh-pages
         env: