chore: add license headers and CI

.github/workflows/npm_publish_bq_scripts.yml

@@ -14,9 +14,11 @@ jobs:
     runs-on: ubuntu-latest
     name: publish_if_newer_version
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 24
       - name: NPM install

.github/workflows/readmes-updated.yml

@@ -20,17 +20,20 @@ env:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
           ref: ${{ github.event.pull_request.head.ref }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          persist-credentials: false
       - name: Set up Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7
         with:
           node-version: 22
           cache: "npm"
@@ -44,7 +47,7 @@ jobs:
           echo "::set-output name=dir::$(npm config get prefix)"
 
       - name: Cache global dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         with:
           path: ${{ steps.global-deps-setup.outputs.dir }}
           key:
@@ -54,8 +57,10 @@ jobs:
             ${{ runner.os }}-npm-global-deps-v1-
 
       - name: Install Firebase and Lerna
+        env:
+          GLOBAL_DEPS_DIR: ${{ steps.global-deps-setup.outputs.dir }}
         run: |
-          echo "${{ steps.global-deps-setup.outputs.dir }}/bin" >> $GITHUB_PATH
+          echo "$GLOBAL_DEPS_DIR/bin" >> $GITHUB_PATH
           npm install -g firebase-tools lerna
 
       - name: Install local dependencies