ci: pin all actions to commit SHAs, tighten token permissions

[theoephraim]

What

Audit of .github/workflows. Every uses: is now pinned to the full commit SHA its tag resolved to on 2026-10-14, with a # vX.Y.Z comment. No version changes, so no behavior change.

Action	Pinned
actions/checkout	v7.0.1 (bumpy-check, bumpy-comment), v6.1.0 (ci, release, pullfrog)
oven-sh/setup-bun	v2.2.0
actions/upload-artifact	v4.6.2
actions/download-artifact	v4.3.0
actions/setup-node	v6.5.0
pullfrog/pullfrog	v0.1.98

Also from the audit:

• Least-privilege tokens. ci.yaml and on-release.yaml had no permissions block. The repo's default workflow token permission is write, so they ran with write-all. Now contents: read and {} respectively.
• No expression interpolation in shell. on-release.yaml echoed release name/tag/author straight into a run: script; release.yaml did the same with the packages output. Both moved to env.
• Dependabot config for the github-actions ecosystem (weekly, grouped) so the SHA pins get bumped together with their version comments.

Reviewer notes

• pullfrog.yml says DO NOT EDIT. Pinned anyway; a pullfrog-managed regeneration may revert it to @v0.
• Not changed, worth considering separately:
  • Flip the repo setting Settings → Actions → General → default workflow permissions to read.
  • Version drift: upload-artifact v4 (current v7), download-artifact v4 (current v8), setup-node v6 (current v7), checkout split v6/v7. Upload/download must stay on the same major; Dependabot will propose bumps.
  • node-version: latest + npm install -g npm@latest on the publish job (the one with id-token: write) are unpinned.
  • Docs examples still use @vN tags (fine for docs), but docs/snapshots.md references checkout@v4 / setup-node@v4.

🤖 Generated with Claude Code

[pullfrog]

✅ No new issues found.

Reviewed changes across the seven workflow and configuration files, including immutable action references, token scopes, shell-expression handling, and automated pin maintenance.

• Immutable action pins — Every uses: reference is pinned to a full SHA, and each SHA independently resolves to the exact version named in its comment.
• Least-privilege tokens — ci.yaml now grants only contents: read, while the event-only verification workflow grants no token permissions; both remain sufficient for their jobs.
• Safer shell inputs — Release metadata and generated package output are passed through step environment variables rather than interpolated into shell source.
• Automated maintenance — Dependabot now groups weekly GitHub Actions updates so the pinned revisions and version comments can remain current.

  ^{｜ View workflow run ｜ Using gpt-5.6-sol ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes since the prior Pullfrog review at ed0ee77, covering the trusted commenter permission adjustment and the corrected workflow documentation.

• Expanded trusted commenter access — Added contents: read so the default-branch checkout also works in private repositories while retaining only the required PR write scope.
• Corrected CLI examples — Replaced the stale package invocation and token variable with @varlock/bumpy and GH_TOKEN, matching the published package and CLI conventions.
• Stabilized release tooling examples — Pinned the documented runtime to Node 24 and npm 11 and limited generated GitHub App tokens to the permissions Bumpy needs.
• Updated snapshot guidance — Refreshed checkout/setup-node majors and documented the explicit workflow permissions required for checkout and PR comments.

  ^{｜ View workflow run ｜ Using gpt-5.6-sol ｜ 𝕏}