chore: scope GITHUB_TOKEN to contents: read in workflows

* chore: pin GitHub Actions to commit SHAs

* chore: pin GitHub Actions to commit SHAs

* chore: pin GitHub Actions to commit SHAs

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,10 +1,16 @@
-| Q             | A
-| ------------- | ---
-| Bug fix?      | yes/no
-| New feature?  | yes/no
-| Fixed tickets | #... <!-- #-prefixed issue number(s), if any -->
-
 <!--
-- Replace this comment by a description of what your PR is solving.
+- Fill in the form below correctly. This will help the Pest team to understand the PR and also work on it.
 -->
 
+### What:
+
+- [ ] Bug Fix
+- [ ] New Feature
+
+### Description:
+
+<!-- describe what your PR is solving -->
+
+### Related:
+
+<!-- link to the issue(s) your PR is solving. If it doesn't exist, remove the "Related" section. -->

.github/workflows/changelog.yml

@@ -10,6 +10,9 @@ on:
     branches: [ 1.x ]
     paths:
       - CHANGELOG.md
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -17,10 +20,10 @@ jobs:
     if: github.repository == 'pestphp/pest'
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
 
     - name: Checkout website repository
-      uses: actions/checkout@v2
+      uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
       with:
         token: ${{ secrets.CHANGELOG_KEY }}
         repository: pestphp/docs
@@ -29,12 +32,12 @@ jobs:
 
     - name: Read CHANGELOG.md
       id: package
-      uses: juliangruber/read-file-action@v1
+      uses: juliangruber/read-file-action@271ff311a4947af354c6abcd696a306553b9ec18 # v1
       with:
         path: ./CHANGELOG.md
 
     - name: Add file headers
-      uses: DamianReeves/write-file-action@v1.0
+      uses: DamianReeves/write-file-action@e19fd875ed54f16fc583a3486e62547ce4a5dde8 # v1.0
       with:
         path: ./CHANGELOG.md
         contents: |
@@ -53,7 +56,7 @@ jobs:
       run: cp CHANGELOG.md pestphp-docs/changelog.md
 
     - name: Create Pull Request
-      uses: peter-evans/create-pull-request@v3
+      uses: peter-evans/create-pull-request@18f7dc018cc2cd597073088f7c7591b9d1c02672 # v3
       with:
         token: ${{ secrets.CHANGELOG_KEY }}
         commit-message: Update changelog.md

.github/workflows/static.yml

@@ -2,6 +2,9 @@ name: Static Analysis
 
 on: ['push', 'pull_request']
 
+permissions:
+  contents: read
+
 jobs:
   cs:
     runs-on: ubuntu-latest
@@ -10,10 +13,10 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
 
     - name: Setup PHP
-      uses: shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
       with:
         php-version: 8.0
         tools: composer:v2
@@ -35,10 +38,10 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
 
     - name: Setup PHP
-      uses: shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
       with:
         php-version: 8.0
         tools: composer:v2

.github/workflows/tests.yml

@@ -2,6 +2,9 @@ name: Tests
 
 on: ['push', 'pull_request']
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     runs-on: ${{ matrix.os }}
@@ -25,10 +28,10 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
 
     - name: Setup PHP
-      uses: shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
       with:
         php-version: ${{ matrix.php }}
         tools: composer:v2