Harden ci

.github/workflows/build.yml

@@ -12,24 +12,29 @@ concurrency:
   group: "pages"
   cancel-in-progress: false
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup bundler cache
-        uses: actions/cache@v3
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           key: ${{ runner.os }}-bundler-${{ hashFiles('Gemfile.lock') }}
           path: .bundle/gems
       - name: Setup build cache
-        uses: actions/cache@v3
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           key: ${{ runner.os }}-build
           path: __build
       - name: Setup Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: '3.3'
       - name: Install dependencies
@@ -43,8 +48,10 @@ jobs:
           BUILD_OUTPUT="__build" bundle exec middleman build
       - name: Generate HTML Preview
         id: html_preview
-        uses: pavi2410/html-preview-action@v2
+        uses: pavi2410/html-preview-action@b58683c238478d5f8b5dacf4fe5e3f403afb449a # v5
         with:
           html_file: '__build/index.html'
       - name: Access preview
-        run: echo "${{steps.html_preview.outputs.url}}"
+        run: echo "${STEPS_HTML_PREVIEW_OUTPUTS_URL}"
+        env:
+          STEPS_HTML_PREVIEW_OUTPUTS_URL: ${{steps.html_preview.outputs.url}}

.github/workflows/middleman_deploy.yml

@@ -30,20 +30,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Pages
-        uses: actions/configure-pages@v4
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
       - name: Setup Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: '3.3'
       - name: Setup bundler cache
-        uses: actions/cache@v3
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           key: ${{ runner.os }}-bundler-${{ hashFiles('Gemfile.lock') }}
           path: .bundle/gems
       - name: Setup build cache
-        uses: actions/cache@v3
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           key: ${{ runner.os }}-source-build
           path: __source_build
@@ -60,10 +62,10 @@ jobs:
         if: ${{ github.repository == 'rspec/rspec.github.io' }}
         run: echo "rspec.info" > CNAME
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           # Upload entire repository
           path: '__source_build'
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1