feat(ci): pin versions, tighten permissions

.github/workflows/security-trends.yml

@@ -8,6 +8,10 @@ on:
     types:
       - completed
 
+permissions:
+  contents: read
+  actions: read
+
 jobs:
   analyze-trends:
     runs-on: ubuntu-latest
@@ -16,20 +20,20 @@ jobs:
       issues: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: main
           fetch-depth: 0
 
       - name: Download latest results
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           name: security-reports-${{ github.event.workflow_run.id }}
           path: latest-results
 
       - name: Analyze Trends
         id: analyze
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
             const fs = require('fs');
@@ -82,7 +86,7 @@ jobs:
         if: |
           github.event.workflow_run.conclusion == 'success' &&
           steps.verify.outputs.exists == 'true'
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
             try {