ci: pin action hashes and escape variables with minimum permission

.github/workflows/deno.yml

@@ -2,20 +2,25 @@ name: Deno
 
 on:
   push:
-    branches: [main]
+    branches:
+      - main
   pull_request:
-    branches: [main]
+    branches:
+      - main
 
 jobs:
   deno:
     runs-on: ubuntu-latest
-
+    permissions:
+      contents: read
     steps:
       - name: Setup repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Setup Deno
-        uses: denoland/setup-deno@v2
+        uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3
         with:
           deno-version: v1.x
 
@@ -26,7 +31,7 @@ jobs:
         run: deno task coverage
 
       - name: Upload coverage to CodeCov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
         with:
           file: ./lcov.info
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/e2e.yml

@@ -3,15 +3,20 @@ name: Internal E2E CI
 
 on:
   push:
-    branches: [main]
+    branches:
+      - main
   pull_request:
 
 jobs:
   e2e:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout the sdk
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - name: Set environment variables
         run: |
           # Short name for current branch. For PRs, use source branch (GITHUB_HEAD_REF)

.github/workflows/npm-publish.yml

@@ -11,19 +11,22 @@ on:
 jobs:
   build:
     runs-on: macos-latest
-
+    permissions:
+      contents: read
     steps:
       - name: Actions checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: latest
           registry-url: https://registry.npmjs.org/
 
       - name: Setup Deno
-        uses: denoland/setup-deno@v2
+        uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3
         with:
           deno-version: v1.x
 
@@ -32,7 +35,9 @@ jobs:
         run: echo "TAG=${GITHUB_REF#refs/*/}" >> $GITHUB_OUTPUT
 
       - name: Run build_npm.ts
-        run: deno run -A scripts/build_npm.ts ${{steps.get_tag_name.outputs.TAG}}
+        run: deno run -A scripts/build_npm.ts "$TAG"
+        env:
+          TAG: ${{steps.get_tag_name.outputs.TAG}}
 
       - name: Publish to NPM
         run: cd npm && npm publish --access=public

.github/workflows/npm.yml

@@ -4,26 +4,31 @@ name: Npm Build
 
 on:
   push:
-    branches: [ main ]
+    branches:
+      - main
   pull_request:
-    branches: [ main ]
+    branches:
+      - main
 
 jobs:
   build:
     runs-on: macos-latest
-
+    permissions:
+      contents: read
     steps:
       - name: Actions checkout
-        uses: actions/checkout@v4
-
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: latest
           registry-url: https://registry.npmjs.org/
-          
+
       - name: Setup Deno
-        uses: denoland/setup-deno@v2
+        uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3
         with:
           deno-version: v1.x
 

.github/workflows/samples.yml

@@ -3,9 +3,11 @@ name: Samples Integration Type-checking
 
 on:
   push:
-    branches: [main]
+    branches:
+      - main
   pull_request:
-    branches: [main]
+    branches:
+      - main
 
 jobs:
   samples:
@@ -19,25 +21,29 @@ jobs:
           - slack-samples/deno-message-translator
           - slack-samples/deno-request-time-off
           - slack-samples/deno-simple-survey
-
+    permissions:
+      contents: read
     steps:
       - name: Setup Deno
-        uses: denoland/setup-deno@v2
+        uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3
         with:
           deno-version: v1.x
 
       - name: Checkout the sdk
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           path: ./deno-slack-sdk
+          persist-credentials: false
+
       - name: Checkout the ${{ matrix.sample }} sample
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           repository: ${{ matrix.sample }}
           path: ./sample
+          persist-credentials: false
 
       - name: Set imports.deno-slack-sdk/ to ../deno-slack-sdk/src/ in import_map.json
-        run: > 
+        run: >
           deno run
           --allow-read --allow-write 
           deno-slack-sdk/scripts/import_map/update.ts