ci: pin GitHub Actions to current stable SHAs

.github/dependabot.yml

@@ -4,13 +4,17 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 7
     labels:
       - ":game_die: dependencies"
       - ":robot: bot"
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 7
     labels:
       - ":game_die: dependencies"
       - ":robot: bot"

.github/workflows/build.yml

@@ -1,18 +1,19 @@
 name: build
 
-# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
 on:
-  pull_request:
-    branches:
-      - 'master'
   push:
     branches:
       - 'master'
     tags:
       - '*.*.*'
+  pull_request:
 
 env:
   VERSION: "0.0.0"
@@ -21,8 +22,7 @@ jobs:
   release:
     runs-on: windows-latest
     permissions:
-      # required to create GitHub release
-      contents: write
+      contents: write # required to create GitHub release
     steps:
       -
         name: Prepare
@@ -33,36 +33,36 @@ jobs:
         shell: bash
       -
         name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: 1.19
           cache: true
       -
         name: Mage build
-        uses: magefile/mage-action@v2
+        uses: magefile/mage-action@a662bd8c29d8106879588cfff83b2faf6e6f59db # v4.0.0
         with:
           version: latest
           args: build
       -
         name: Mage chocoPack
-        uses: magefile/mage-action@v2
+        uses: magefile/mage-action@a662bd8c29d8106879588cfff83b2faf6e6f59db # v4.0.0
         with:
           version: latest
           args: chocoPack
       -
         name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: WindowsSpyBlocker
           path: |
             bin/WindowsSpyBlocker.exe
             bin/windowsspyblocker.${{ env.VERSION }}.nupkg
       -
         name: GitHub Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         if: startsWith(github.ref, 'refs/tags/')
         with:
           draft: true
@@ -72,7 +72,7 @@ jobs:
           name: ${{ env.VERSION }}
       -
         name: Mage chocoPush
-        uses: magefile/mage-action@v2
+        uses: magefile/mage-action@a662bd8c29d8106879588cfff83b2faf6e6f59db # v4.0.0
         if: startsWith(github.ref, 'refs/tags/')
         env:
           CHOCO_API_KEY: ${{ secrets.CHOCO_API_KEY }}

.github/workflows/docs.yml

@@ -1,6 +1,9 @@
 name: docs
 
-# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
@@ -25,12 +28,11 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     permissions:
-      # required to push to gh-pages
-      contents: write
+      contents: write # required to push to gh-pages
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       -
@@ -57,13 +59,13 @@ jobs:
           sudo chown -R $(id -u):$(id -g) ./site
       -
         name: Check GitHub Pages status
-        uses: crazy-max/ghaction-github-status@v3
+        uses: crazy-max/ghaction-github-status@f0ef9e1cf727f9f76f8485f8c525fa03afc4ec02 # v5.0.0
         with:
           pages_threshold: major_outage
       -
         name: Deploy
         if: github.event_name != 'pull_request' && (endsWith(github.ref, github.event.repository.default_branch) || env.RELEASE == 'true')
-        uses: crazy-max/ghaction-github-pages@v3
+        uses: crazy-max/ghaction-github-pages@1d6ee9b181a81033a16bd707a1401afa978daab4 # v5.0.0
         with:
           target_branch: gh-pages
           build_dir: site

.github/workflows/labels.yml

@@ -1,6 +1,9 @@
 name: labels
 
-# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
@@ -20,16 +23,14 @@ jobs:
   labeler:
     runs-on: ubuntu-latest
     permissions:
-      # same as global permissions
-      contents: read
-      # required to update labels
-      issues: write
+      contents: read # same as global permissions
+      issues: write # required to update labels
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Run Labeler
-        uses: crazy-max/ghaction-github-labeler@v5
+        uses: crazy-max/ghaction-github-labeler@548a7c3603594ec17c819e1239f281a3b801ab4d # v6.0.0
         with:
           dry-run: ${{ github.event_name == 'pull_request' }}

.github/workflows/released.yml

@@ -1,6 +1,5 @@
 name: released
 
-# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
 permissions:
   contents: read
 
@@ -13,12 +12,11 @@ jobs:
   virustotal:
     runs-on: ubuntu-latest
     permissions:
-      # required to write GitHub Release body
-      contents: write
+      contents: write # required to write GitHub Release body
     steps:
       -
         name: VirusTotal Monitor Scan
-        uses: crazy-max/ghaction-virustotal@v4
+        uses: crazy-max/ghaction-virustotal@936d8c5c00afe97d3d9a1af26d017cfdf26800a2 # v5.0.0
         with:
           vt_api_key: ${{ secrets.VT_MONITOR_API_KEY }}
           vt_monitor: true
@@ -28,7 +26,7 @@ jobs:
             WindowsSpyBlocker.exe
       -
         name: VirusTotal Scan
-        uses: crazy-max/ghaction-virustotal@v4
+        uses: crazy-max/ghaction-virustotal@936d8c5c00afe97d3d9a1af26d017cfdf26800a2 # v5.0.0
         with:
           vt_api_key: ${{ secrets.VT_API_KEY }}
           update_release_body: true

.github/workflows/zizmor.yml

@@ -0,0 +1,26 @@
+name: zizmor
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - 'master'
+  pull_request:
+
+jobs:
+  run:
+    uses: crazy-max/.github/.github/workflows/zizmor.yml@f91220cba053bd54299ba645a599ee8ed436f222 # v1.11.0
+    permissions:
+      contents: read
+      security-events: write
+    with:
+      min-severity: medium
+      min-confidence: medium
+      persona: pedantic