ci: harden GitHub Actions supply chain

Remove the unused, unpinned denolib/setup-deno@v2 third-party action from
the release and test workflows (Deno is used nowhere in the repo), pin
every remaining action to a full commit SHA, and add least-privilege
permissions blocks.

- release.yml: drop the Setup Deno step; pin checkout, setup-node, and
  attest-build-provenance to SHAs; add a top-level default-deny
  `permissions: {}` while the release job keeps its explicit write grants.
- test.yml: drop the Setup Deno step; upgrade checkout v2 (EOL Node 16) to
  v4 pinned to a SHA; pin setup-node; add `permissions: contents: read`.
- documentation.yml: pin checkout and setup-python to SHAs; add
  `permissions: contents: read`.

Resolves deepsec findings other-ci-supply-chain (0995a86e73, e6c687034d).

Author: chhoumann

.github/workflows/documentation.yml

@@ -9,13 +9,16 @@ on:
       - '.github/workflows/documentation.yml'
       - 'wrangler.jsonc'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: 3.x
 

.github/workflows/release.yml

@@ -11,6 +11,9 @@ on:
   repository_dispatch:
     types: [release-trigger]
 
+# Default-deny baseline; the release job grants only the scopes it needs below.
+permissions: {}
+
 jobs:
   release:
     name: Release
@@ -29,22 +32,17 @@ jobs:
       version: ${{ steps.extract-version.outputs.version }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: ${{ matrix.node-version }}
           cache: npm
 
-      - name: Setup Deno
-        uses: denolib/setup-deno@v2
-        with:
-          deno-version: v1.x
-
       - name: Validate trigger
         id: validate
         run: |
@@ -103,7 +101,7 @@ jobs:
       # by this workflow (GitHub attestations API).
       - name: Attest build provenance for release assets
         if: steps.release.outputs.released == 'true'
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
         with:
           subject-path: |
             main.js

.github/workflows/test.yml

@@ -1,24 +1,23 @@
 name: Test
 on: push
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: 'npm'
-      - name: Setup Deno
-        uses: denolib/setup-deno@v2
-        with:
-            deno-version: v1.x
       - name: Install dependencies
         run: npm install
       - name: Lint