From abed2e0b17847254cb3d99ee9ba609de918a172c Mon Sep 17 00:00:00 2001
From: LinXunFeng <xunfenghellolo@gmail.com>
Date: Sat, 22 Aug 2026 16:13:50 +0800
Subject: [PATCH] ci(workflows): pin actions to hashes and restrict token
 permissions

zizmor reports 8 high and 6 medium findings on the three workflows:

- unpinned-uses / ref-confusion: every action is referenced by a mutable tag,
  so pin them to commit hashes with the version kept as a trailing comment.
- excessive-permissions: no workflow declares a permissions block, so the jobs
  fall back to the default token scope. Declare `permissions: {}` at the
  workflow level and keep only what each job actually needs.
- artipacked: actions/checkout persists the token in .git/config by default,
  and none of these workflows push through it, so set persist-credentials to
  false. The gh-pages deploy authenticates with its own github_token input.

`zizmor .github/workflows/` now reports no findings.
---
 .github/workflows/assign-issue.yml  |  4 +++-
 .github/workflows/code-analysis.yml | 15 +++++++++++----
 .github/workflows/deploy.yml        | 11 ++++++++---
 3 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/assign-issue.yml b/.github/workflows/assign-issue.yml
index ab833ad..a31eb14 100644
--- a/.github/workflows/assign-issue.yml
+++ b/.github/workflows/assign-issue.yml
@@ -4,6 +4,8 @@ on:
   issues:
     types: [opened]
 
+permissions: {}
+
 jobs:
   auto-assign:
     runs-on: ubuntu-latest
@@ -11,7 +13,7 @@ jobs:
       issues: write
     steps:
       - name: 'Auto-assign issue'
-        uses: pozil/auto-assign-issue@v1
+        uses: pozil/auto-assign-issue@65947009a243e6b3993edeef4e64df3ca85d760c # v1.14.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           assignees: LinXunFeng
\ No newline at end of file
diff --git a/.github/workflows/code-analysis.yml b/.github/workflows/code-analysis.yml
index b86942e..7982c2f 100644
--- a/.github/workflows/code-analysis.yml
+++ b/.github/workflows/code-analysis.yml
@@ -13,12 +13,17 @@ on:
     paths-ignore:
       - '**.md'
 
+permissions:
+  contents: read
+
 jobs:
   code-analysis:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: subosito/flutter-action@v2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
         with:
           channel: 'stable'
       - name: Prepare dependencies
@@ -43,8 +48,10 @@ jobs:
       matrix:
         flutter-version: ['']
     steps:
-      - uses: actions/checkout@v4
-      - uses: subosito/flutter-action@v2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
         with:
           channel: 'stable'
           flutter-version: ${{ matrix.flutter-version }}
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index c13739a..50de2a4 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -4,6 +4,9 @@ on:
     branches:
       - main
       # - develop
+
+permissions: {}
+
 jobs:
   build:
     name: Build Web
@@ -13,8 +16,10 @@ jobs:
       my_secret: ${{secrets.commit_secret}}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: subosito/flutter-action@v2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
         with:
           # flutter-version: '3.16.9'
           channel: 'stable'
@@ -25,7 +30,7 @@ jobs:
           flutter pub get
           flutter build web --release --base-href /flutter_scrollview_observer/
       - name: Deploy
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 # v3.9.3
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./example/build/web