From 4624b3a0b91dbe5ec74ca8cefb5b3074d32dae97 Mon Sep 17 00:00:00 2001
From: rishigupta1599 <rishi@browserstack.com>
Date: Tue, 27 Oct 2026 23:53:02 +0530
Subject: [PATCH 1/2] ci: SHA-pin actions and add least-privilege permissions
 (PER-8930, PER-8940, PER-8941)

Pin cadwallion/publish-rubygems-action (was @master, RUBYGEMS_API_KEY in scope)
to a commit SHA, pin the other actions in release/lint/changelog/stale, and add
explicit minimal `permissions:` blocks. test.yml is left for a follow-up to
avoid conflicting with open PR #43.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/changelog.yml |  5 ++++-
 .github/workflows/lint.yml      |  8 +++++---
 .github/workflows/release.yml   | 10 ++++++----
 .github/workflows/stale.yml     |  6 +++++-
 4 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
index 22a7ab3..a7ecd8f 100644
--- a/.github/workflows/changelog.yml
+++ b/.github/workflows/changelog.yml
@@ -2,10 +2,13 @@ name: Changelog
 on:
   push:
     branches: [main]
+permissions:
+  contents: write
+  pull-requests: read
 jobs:
   update_draft:
     runs-on: ubuntu-latest
     steps:
-      - uses: release-drafter/release-drafter@v5
+      - uses: release-drafter/release-drafter@09c613e259eb8d4e7c81c2cb00618eb5fc4575a7 # v5.25.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 549eb12..0ca6609 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -4,17 +4,19 @@ on:
     branches: [main]
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: ruby/setup-ruby@v1
+      - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0
+      - uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1.335.0
         with:
           ruby-version: 2.6
           bundler-cache: true
-      - uses: actions/cache@v3
+      - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
         with:
           path: "./vendor/bundle"
           key: v1/${{ runner.os }}/ruby-2.6/${{ hashFiles('**/Gemfile.lock') }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c264863..f602917 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -2,21 +2,23 @@ name: Release
 on:
   release:
     types: [published]
+permissions:
+  contents: read
 jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: ruby/setup-ruby@v1
+      - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0
+      - uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1.335.0
         with:
           ruby-version: 2.6
           bundler-cache: true
-      - uses: actions/cache@v3
+      - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
         with:
           path: "./vendor/bundle"
           key: v1/${{ runner.os }}/ruby-2.6/${{ hashFiles('**/Gemfile.lock') }}
           restore-keys: v1/${{ runner.os }}/ruby-2.6/
-      - uses: cadwallion/publish-rubygems-action@master
+      - uses: cadwallion/publish-rubygems-action@94a6f4cd5350581749c569b5001eecc864e3ad0b # v1.1.0
         env:
           RUBYGEMS_API_KEY: ${{secrets.RUBYGEMS_API_KEY}}
           RELEASE_COMMAND: make release
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index c643e13..e7e08aa 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -3,11 +3,15 @@ on:
   schedule:
     - cron: '0 19 * * 2'
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v4
+      - uses: actions/stale@a20b814fb01b71def3bd6f56e7494d667ddf28da # v4.1.1
         with:
           stale-issue-message: >-
             This issue is stale because it has been open for more than 14 days with no activity.

From f814951efacbcdc55f80ec08862395ec4b4657e1 Mon Sep 17 00:00:00 2001
From: rishigupta1599 <rishi@browserstack.com>
Date: Wed, 28 Oct 2026 00:09:45 +0530
Subject: [PATCH 2/2] ci: disable checkout credential persistence in lint and
 release workflows

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/lint.yml    | 2 ++
 .github/workflows/release.yml | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 0ca6609..0d52e20 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -12,6 +12,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0
+        with:
+          persist-credentials: false
       - uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1.335.0
         with:
           ruby-version: 2.6
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f602917..b1303d4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,6 +9,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0
+        with:
+          persist-credentials: false
       - uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1.335.0
         with:
           ruby-version: 2.6