Pin GitHub Actions workflow step hashes and use minimum permission

[zimeg]

Summary

This PR uses the wonderful zizmor tool to audit our own workflows and pinact for pinned versioning 👾

Category

• Other

Reviewers

A similar audit can be performed with the zizmor tool:

$ zizmor .
...
No findings to report. Good job! (6 suppressed)

The suppressed findings are expected permission blocks at the top-level of a workflow, but we set this for each job.

Requirements

Please read the Contributing guidelines and Code of Conduct before creating this issue or pull request. By submitting, you agree to those rules.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 73.06%. Comparing base (2a6f7dd) to head (4c04a6b).
Report is 1 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #1474      +/-   ##
============================================
- Coverage     73.11%   73.06%   -0.05%     
+ Complexity     4382     4381       -1     
============================================
  Files           475      475              
  Lines         14244    14244              
  Branches       1447     1447              
============================================
- Hits          10415    10408       -7     
- Misses         2970     2977       +7     
  Partials        859      859              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[zimeg]

💌 Notes for the most wonderful reviewers and readers alike!

[zimeg]

📣 Permissions for the build step are proving alright with just read! This is interesting to me, but makes sense in the context of uploading artifacts to action outputs perhaps?

📚 https://github.com/slackapi/java-slack-sdk/actions/runs/15126115805?pr=1474

[WilliamBergamin]

Makes sense 👍

[zimeg]

🗣️ Changes unrelated to hashing steps are due to indentation! No change to testing or functionalities otherwise.

[WilliamBergamin]

LGTM

[WilliamBergamin]

Makes sense 👍

[zimeg]

@WilliamBergamin Thank you for reviewing this! I am optimistic that CI will continue to remain stable here 🙏 ✨