From 2a4034e3e6ca997a133656a2e26a7d178dfca849 Mon Sep 17 00:00:00 2001
From: Randy Goodman <1679433+RGood@users.noreply.github.com>
Date: Tue, 10 Nov 2026 13:15:11 -0500
Subject: [PATCH] ci: declare job permissions and pin actions to full SHAs
 (M04, M06)

---
 .github/dependabot.yml    | 4 ++++
 .github/workflows/ci.yaml | 9 +++++++--
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index cf2a042..f9d690f 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -39,3 +39,7 @@ updates:
           - "react-dom"
           - "@types/react"
           - "@types/react-dom"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 3ee9d3d..70fac4c 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -7,14 +7,19 @@ on:
   pull_request:
     branches: ['main']
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Install Node.js
-        uses: actions/setup-node@v6.4.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24.18.0
       - name: Install Dependencies