CI: Harden GHA configuration

.github/dependabot.yml

@@ -0,0 +1,7 @@
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"      # Location of your workflow files
+    schedule:
+      interval: "weekly"  # Options: daily, weekly, monthly

.github/workflows/check.yml

@@ -1,4 +1,6 @@
 name: "Check with pre-commit"
+permissions:
+  contents: read
 on:
   push:
     branches: ["main"]
@@ -14,6 +16,8 @@ jobs:
 
     steps:
       - uses: "actions/checkout@v3"
+        with:
+          persist-credentials: false
 
       - name: "Set up Python ${{ matrix.python-version }}"
         uses: "actions/setup-python@v4"

.github/workflows/release.yml

@@ -1,4 +1,6 @@
 name: "Release"
+permissions:
+  contents: read
 on:
   release:
     types:
@@ -10,6 +12,8 @@ jobs:
     runs-on: "ubuntu-latest"
     steps:
       - uses: "actions/checkout@v3"
+        with:
+          persist-credentials: false
 
       - name: "Set up Python"
         uses: "actions/setup-python@v4"
@@ -23,6 +27,6 @@ jobs:
         run: "python -m build"
 
       - name: "Publish to PyPI"
-        uses: "pypa/gh-action-pypi-publish@release/v1"
+        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4
         with:
           password: "${{ secrets.PYPI_TOKEN }}"

.github/workflows/test.yml

@@ -1,4 +1,6 @@
 name: "Test"
+permissions:
+  contents: read
 on:
   push:
     branches: ["main"]
@@ -20,6 +22,8 @@ jobs:
 
     steps:
       - uses: "actions/checkout@v3"
+        with:
+          persist-credentials: false
 
       - name: "Set up Python ${{ matrix.python-version }}"
         uses: "actions/setup-python@v4"