chore(ci): Dependabot, workflow security (#1257)

Co-authored-by: StepSecurity Bot <bot@stepsecurity.io>
Co-authored-by: niStee <52573120+niStee@users.noreply.github.comclear>
Co-authored-by: GideonBear <87426140+GideonBear@users.noreply.github.com>

.github/workflows/ci.yml

@@ -10,13 +10,16 @@ env:
   CROSS_VER: '0.2.5'
   CARGO_NET_RETRY: 3
 
+permissions:
+  contents: read
+
 jobs:
   fmt:
     name: Rustfmt
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
 
       - name: Run cargo fmt
         env:
@@ -30,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
 
       - name: Check if `Step` enum is sorted
         run: |
@@ -47,7 +50,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
 
       - name: Check if `Step::run()`'s match is sorted
         run: |
@@ -55,7 +58,7 @@ jobs:
           awk '/[[:alpha:]] =>/{print $1}' $FILE > original.txt
           sort original.txt > sorted.txt
           diff original.txt sorted.txt
-  
+
   main:
     needs: [ fmt, step-enum-sorted, step-match-sorted ]
     name: ${{ matrix.target_name }} (check, clippy)
@@ -96,10 +99,10 @@ jobs:
             os: windows-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
 
       - name: Setup Rust Cache
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
         with:
           prefix-key: ${{ matrix.target }}