fix: harden GitHub Actions workflows

.github/workflows/codeql-analysis.yml

@@ -15,6 +15,9 @@ on:
   schedule:
     - cron: '18 7 * * 5'
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze
@@ -33,19 +36,19 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@603b797f8b14b413fe025cd935a91c16c4782713 # v3
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
         # By default, queries listed here will override any specified in a config file.
         # Prefix the list here with "+" to use these queries and those in the config file.
-        
+
         # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
         # queries: security-extended,security-and-quality
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@603b797f8b14b413fe025cd935a91c16c4782713 # v3

.github/workflows/pypi-release.yml

@@ -9,13 +9,16 @@ on:
         required: false
         default: 'false'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test Release
     runs-on: ubuntu-latest
     steps:
       - name: Publish to pypi
-        uses: coveooss/pypi-publish-with-poetry@v1.0.0
+        uses: coveooss/pypi-publish-with-poetry@84aa0405b3e10921dcab065f86b583a402dd58c8 # v1
         with:
           project-name: secrules-parsing
           pypi-token: ${{ secrets.PYPI_TOKEN }}

.github/workflows/test.yml

@@ -9,6 +9,8 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
 
 jobs:
   regression:
@@ -20,10 +22,10 @@ jobs:
 
     steps:
       - name: "Checkout repo"
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Set up Python 3
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: ${{ matrix.python-version }}