fix: workflows security issues (#592)

* ci: fix unpinned tag for a non-immutable action in workflow

* ci: fix workflow does not contain permissions

Author: leovct

.github/workflows/ci.yml

@@ -6,12 +6,15 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ci-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 env:
-  GO_VERSION: "1.23" # https://go.dev/dl/  
+  GO_VERSION: "1.23" # https://go.dev/dl/
   FOUNDRY_VERSION: stable
 
 jobs:
@@ -35,10 +38,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      
+
       - name: gen-doc
         run: make gen-doc
-        
+
       - name: Check if generated files are up to date
         run: |
           if [[ -n $(git status --porcelain) ]]; then
@@ -56,7 +59,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      
+
       - name: gen-proto
         run: make gen-proto
 
@@ -77,10 +80,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      
+
       - name: gen-go-bindings
         run: make gen-go-bindings
-        
+
       - name: Check if generated files are up to date
         run: |
           if [[ -n $(git status --porcelain) ]]; then
@@ -101,7 +104,7 @@ jobs:
 
       - name: gen-load-test-modes
         run: make gen-load-test-modes
-        
+
       - name: Check if generated files are up to date
         run: |
           if [[ -n $(git status --porcelain) ]]; then
@@ -122,7 +125,7 @@ jobs:
 
       - name: gen-json-rpc-types
         run: make gen-json-rpc-types
-        
+
       - name: Check if generated files are up to date
         run: |
           if [[ -n $(git status --porcelain) ]]; then
@@ -158,7 +161,7 @@ jobs:
         with:
           go-version: ${{ env.GO_VERSION }}
       - name: Install Foundry
-        uses: foundry-rs/foundry-toolchain@v1
+        uses: foundry-rs/foundry-toolchain@de808b1eea699e761c404bda44ba8f21aba30b2c # v1.3
         with:
           version: ${{ env.FOUNDRY_VERSION }}
       - name: Install Geth

.github/workflows/release.yml

@@ -40,7 +40,7 @@ jobs:
         run: echo "tag=$(git describe --tags --exact-match HEAD)" >> $GITHUB_ENV
 
       - name: Publish binaries
-        uses: svenstaro/upload-release-action@v2
+        uses: svenstaro/upload-release-action@04733e069f2d7f7f0b4aebc4fbdbce8613b03ccd # 2.9.0
         with:
           repo_token: ${{ secrets.GITHUB_TOKEN }}
           tag: ${{ env.tag }}