Update workflows.

io7m · io7m · commit 7d93db18eba6 · 2025-05-15T20:26:02.000Z
diff --git a/.github/workflows/deploy.linux.temurin.lts.yml b/.github/workflows/deploy.linux.temurin.lts.yml
@@ -11,6 +11,9 @@ on:
   push:
     tags: [ com.io7m.quixote-* ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -34,7 +37,7 @@ jobs:
         run: echo "${PGP_SIGNING_KEY}" | gpg -v --import
 
       - name: Log in to Quay.io.
-        uses: redhat-actions/podman-login@v1.7
+        uses: redhat-actions/podman-login@4934294ad0449894bcd1e9f191899d7292469603
         with:
           username: ${{ secrets.QUAY_IO_USERNAME }}
           password: ${{ secrets.QUAY_IO_PASSWORD }}
diff --git a/.github/workflows/main.linux.temurin.current.yml b/.github/workflows/main.linux.temurin.current.yml
@@ -11,6 +11,9 @@ on:
   push:
     branches: [ master, main, develop, feature/*, release/* ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/main.linux.temurin.lts.yml b/.github/workflows/main.linux.temurin.lts.yml
@@ -11,6 +11,9 @@ on:
   push:
     branches: [ master, main, develop, feature/*, release/* ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -47,13 +50,13 @@ jobs:
           path: ./com.io7m.quixote.tests/target/surefire-reports
 
       - name: Coverage
-        uses: codecov/codecov-action@v5.4.2
+        uses: codecov/codecov-action@525fcbf8a05e5933b1ef3c7885da8fd1d7231920
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: com.io7m.quixote.tests/target/site/jacoco-aggregate/jacoco.xml
 
       - name: Log in to Quay.io.
-        uses: redhat-actions/podman-login@v1.7
+        uses: redhat-actions/podman-login@4934294ad0449894bcd1e9f191899d7292469603
         with:
           username: ${{ secrets.QUAY_IO_USERNAME }}
           password: ${{ secrets.QUAY_IO_PASSWORD }}
diff --git a/.github/workflows/main.windows.temurin.current.yml b/.github/workflows/main.windows.temurin.current.yml
@@ -11,6 +11,9 @@ on:
   push:
     branches: [ master, main, develop, feature/*, release/* ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: windows-latest
diff --git a/.github/workflows/main.windows.temurin.lts.yml b/.github/workflows/main.windows.temurin.lts.yml
@@ -11,6 +11,9 @@ on:
   push:
     branches: [ master, main, develop, feature/*, release/* ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: windows-latest
diff --git a/.github/workflows/pr.linux.temurin.current.yml b/.github/workflows/pr.linux.temurin.current.yml
@@ -11,6 +11,9 @@ on:
   pull_request:
     branches: [ master, main, develop, feature/*, release/* ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/pr.linux.temurin.lts.yml b/.github/workflows/pr.linux.temurin.lts.yml
@@ -11,6 +11,9 @@ on:
   pull_request:
     branches: [ master, main, develop, feature/*, release/* ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/pr.windows.temurin.current.yml b/.github/workflows/pr.windows.temurin.current.yml
@@ -11,6 +11,9 @@ on:
   pull_request:
     branches: [ master, main, develop, feature/*, release/* ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: windows-latest
diff --git a/.github/workflows/pr.windows.temurin.lts.yml b/.github/workflows/pr.windows.temurin.lts.yml
@@ -11,6 +11,9 @@ on:
   pull_request:
     branches: [ master, main, develop, feature/*, release/* ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: windows-latest
