Improving Security Posture

[dtaivpp]

I've just taken some time to improve the security posture of this repo:

1. Giving workflow steps narrowly scoped permissions
2. Pinning dependencies in workflows to explicit commit hashes

These are really just some cleanup items and this does not necessitate a release.

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

Comments suppressed due to low confidence (1)

.github/workflows/releases.yml:27

• [nitpick] The commit hash b953231f81b8dfd023c58e0854a721e35037f28b should be replaced with a more descriptive tag or version to improve clarity and maintainability.

uses: goreleaser/goreleaser-action@b953231f81b8dfd023c58e0854a721e35037f28b

Tip: Copilot only keeps its highest confidence comments to reduce noise and keep you focused. Learn more