ci: harden workflows with pinned SHAs and explicit permissions

[wizzomafizzo]

Summary

• Pin all third-party GitHub Actions in build.yaml and test.yml to full-length commit SHAs with version comments, so the exact action code running in CI cannot change silently if a tag is force-moved. Dependabot is already configured and will keep these in sync.
• Add a top-level permissions: contents: read default to both workflows. The build job in build.yaml retains contents: write explicitly (job-level) so it can still publish releases; this replaces the previous workflow-wide grant.
• Quote shell variable expansions in build.yaml's release-version and tarball-packaging steps to silence SC2086 warnings reported by actionlint/shellcheck.

Verified with actionlint v1.7.12 — no warnings.

Summary by CodeRabbit

• Chores
  • Enhanced CI/CD security and reliability by implementing explicit permission constraints and pinning external action versions to ensure consistent, secure, and reproducible builds across all workflows.
  • Strengthened build stability through improved environment variable handling in build scripts and more robust file path management in packaging operations to reduce potential build issues.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 523ea730-0bff-42c9-9812-eec3134efb99

📥 Commits

Reviewing files that changed from the base of the PR and between a31181d and ce62679.

📒 Files selected for processing (2)

• .github/workflows/build.yaml
• .github/workflows/test.yml

---

📝 Walkthrough

Walkthrough

GitHub Actions workflows are updated to pin action versions to specific commit SHAs instead of moving tags, add explicit top-level permissions declarations, and quote shell variables and file paths for security hardening across build and test pipelines.

Changes

Cohort / File(s)	Summary
GitHub Actions Workflows .github/workflows/build.yaml, .github/workflows/test.yml	Pinned actions/checkout, actions/setup-node, and related actions from @v6 tags to specific commit SHAs; added top-level permissions: contents: read with job-level overrides in build workflow; added quoting around shell variable assignments and tarball filenames to prevent unquoted expansion and improve security posture.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 With pins and quotes, we hop more secure,
Each SHA, a lock that will surely endure,
Permissions least-granted, our protocols bright,
GitHub's workflows now gleaming with might! ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title 'ci: harden workflows with pinned SHAs and explicit permissions' accurately and concisely summarizes the main changes: pinning GitHub Actions to commit SHAs and adding explicit permissions declarations to CI workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/harden-workflows

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!