From 8b6883e68239e402f34d8331a958a2b43c9f56af Mon Sep 17 00:00:00 2001
From: UE-DND <100979820+UE-DND@users.noreply.github.com>
Date: Wed, 30 Sep 2026 15:33:28 +0800
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20=E5=8A=A0=E5=9B=BA=20GitHub=20Ac?=
 =?UTF-8?q?tions=20=E6=9D=83=E9=99=90=E4=B8=8E=E4=BE=9D=E8=B5=96?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/ci.yml      |  9 +++++++--
 .github/workflows/publish.yml | 12 ++++++++----
 2 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ecee938..f6cc9b8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,6 +8,9 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ci-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -20,9 +23,11 @@ jobs:
       matrix:
         node-version: [22, 24]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
-      - uses: voidzero-dev/setup-vp@v1.21.1
+      - uses: voidzero-dev/setup-vp@3754dd7dbdb32bd8f6d28b6043de13ad3a75f21f # v1.21.1
         with:
           node-version: ${{ matrix.node-version }}
           cache: true
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index e9f923e..2ed4563 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -5,20 +5,24 @@ on:
     tags: ["release-*"]
   workflow_dispatch:
 permissions:
-  contents: write
-  packages: write
+  contents: read
 concurrency:
   group: publish-sdk
   cancel-in-progress: false
 jobs:
   ci:
     uses: ./.github/workflows/ci.yml
+    permissions:
+      contents: read
   publish:
     needs: [ci]
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      packages: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: voidzero-dev/setup-vp@v1.21.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: voidzero-dev/setup-vp@3754dd7dbdb32bd8f6d28b6043de13ad3a75f21f # v1.21.1
         with:
           node-version-file: ".node-version"
           cache: true