Improve GitHub Actions usage

- Pins third-party actions to commit hash - Explicitly sets permissions
anothertobi · Dec 28, 2024 · 303a2bd · 303a2bd
1 parent df642dc
commit 303a2bd
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -19,7 +19,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version: stable
-      - uses: goreleaser/goreleaser-action@v6
+      - uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf
         with:
           version: latest
           args: release --clean

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -2,6 +2,9 @@ name: Go test
 
 on: [push]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest