node: Harden the CI

Author: bbhtt

.github/workflows/node.yaml

@@ -16,6 +16,9 @@ defaults:
 
 jobs:
   node:
+    permissions:
+      contents: read
+    timeout-minutes: 60
     strategy:
       fail-fast: false
       matrix:
@@ -27,26 +30,37 @@ jobs:
           - '3.13'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+        # 4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
+
       - name: Configure git
         run: |
           git config --global user.name 'github-actions[bot]'
           git config --global user.email '41898282+github-actions[bot]@users.noreply.github.com'
-      - uses: actions/setup-python@v4
+
+        # 5.6.0
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: ${{ matrix.python-version }}
+
       - name: Setup Poetry
         run: |
           curl -sSL https://install.python-poetry.org | python3 -
           sudo ln -s /github/home/.local/bin/poetry /usr/bin/poetry
+
       - name: Install OS dependencies
         run: sudo apt-get update && sudo apt-get install -y flatpak-builder
+
       - name: Install Flatpak dependencies
         run: |
           flatpak --user remote-add flathub https://flathub.org/repo/flathub.flatpakrepo
           flatpak --user install -y flathub \
             org.freedesktop.{Platform,Sdk{,.Extension.node{14,16,18}}}//22.08
+
       - name: Install dependencies
         run: poetry install --with=dev
+
       - name: Run checks
         run: poetry run poe check