ci: harden workflows — SHA-pin actions, drop inlined SSH key, least-privilege

.github/workflows/_ci-detect-changes.reusable.yml

@@ -58,7 +58,7 @@ jobs:
           fetch-depth: 0
 
       - name: Detect changed files
-        uses: dorny/paths-filter@v4
+        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4
         id: changes
         with:
           filters: |

.github/workflows/_ci-integration.reusable.yml

@@ -36,7 +36,7 @@ jobs:
 
       # Provides cargo for the Cargo.lock self-version sync integration test (#496). The test is
       # skipped when cargo is absent, so this toolchain is what makes it actually run in CI.
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
 
       - name: Run integration tests
         run: pnpm --filter @releasekit/integration-tests test

.github/workflows/_release.reusable.yml

@@ -79,11 +79,6 @@ jobs:
       - name: Build packages
         run: pnpm build
 
-      - name: Configure git SSH for tag pushes
-        if: ${{ !inputs.dry_run }}
-        run: |
-          git config --global core.sshCommand "ssh -i ${{ secrets.ssh_key }} -o StrictHostKeyChecking=no"
-
       - name: Run releasekit
         id: release
         if: inputs.standing_pr_number == ''

.github/workflows/actions/setup-workspace/action.yml

@@ -10,7 +10,7 @@ runs:
   using: composite
   steps:
     - name: Setup pnpm
-      uses: pnpm/action-setup@v5
+      uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
 
     - name: Setup Node.js
       uses: actions/setup-node@v6

.github/workflows/examples-validate.yml

@@ -95,7 +95,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
 
       - uses: actions/setup-node@v6
         with:

.github/workflows/pr-title.yml

@@ -14,7 +14,7 @@ jobs:
     name: Validate PR Title
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@v6
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6
         env:
           GITHUB_TOKEN: ${{ github.token }}
         with:

.github/workflows/release.yml

@@ -69,6 +69,9 @@ jobs:
   check-labels:
     name: Check Release Labels
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read # reads the merged PR + its labels via `gh api repos/.../commits/.../pulls`
     if: github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push'
     outputs:
       should_release: ${{ steps.check.outputs.should_release }}