security: use commit hash instead of tag for 3rd party actions and add permissions

Author: bugra9

.github/workflows/build-linux.yml

@@ -3,19 +3,25 @@ on:
   push:
     branches:
       - main
+    paths:
+      - packages/**
+      - .github/workflows/build-linux.yml
   pull_request:
     branches:
       - main
     paths:
       - packages/cpp.js/**
       - packages/cppjs-plugin-*/**
+      - .github/workflows/build-linux.yml
+
+permissions: {}
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - name: Install pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 #v4
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:

.github/workflows/build-macos.yml

@@ -3,12 +3,18 @@ on:
   push:
     branches:
       - main
+    paths:
+      - packages/**
+      - .github/workflows/build-macos.yml
   pull_request:
     branches:
       - main
     paths:
       - packages/cpp.js/**
       - packages/cppjs-plugin-*/**
+      - .github/workflows/build-macos.yml
+
+permissions: {}
 jobs:
   build:
     runs-on: macos-latest
@@ -44,7 +50,7 @@ jobs:
           mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
           cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles
       - name: Install pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 #v4
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:

.github/workflows/deploy-website.yml

@@ -6,6 +6,7 @@ on:
       - main
     paths:
       - website/**
+      - .github/workflows/deploy-website.yml
   pull_request:
 
 jobs:
@@ -18,7 +19,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Install pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 #v4
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:
@@ -28,7 +29,7 @@ jobs:
       - name: Build website
         run: pnpm run build:website
       - name: Deploy
-        uses: peaceiris/actions-gh-pages@v4
+        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e #v4
         if: github.ref == 'refs/heads/main'
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}