Harden GitHub Actions

Author: taku0

.github/workflows/deploy.yml

@@ -6,6 +6,8 @@ on:
       - main
   workflow_dispatch: {}
 
+permissions: {}
+
 # Allow only one concurrent deployment, skipping runs queued between the run
 # in-progress and latest queued.
 # However, do NOT cancel in-progress runs as we want to allow these production
@@ -17,13 +19,14 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
-    permissions: read-all
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
 
       - name: Setup Deno
-        uses: denoland/setup-deno@v2
+        uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4
         with:
           deno-version: v2.x
           cache: true
@@ -32,7 +35,7 @@ jobs:
         run: deno task build
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: './site'
 
@@ -48,4 +51,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0