chore: pin GitHub Actions to full-length commit SHAs

[joshuarli]

Summary

• Pin all GitHub Actions references in .github/ workflow files to full-length commit SHAs

Generated by devenv pin_gha.

🤖 Generated with Claude Code

In general, the fix is to add an explicit permissions: block to the workflow (either at the top level to apply to all jobs, or within the specific job) that grants the minimal required permissions to GITHUB_TOKEN. For a dependency update workflow that primarily reads repository contents and likely opens or updates pull requests, a sensible minimal starting point is contents: read plus pull-requests: write if it needs to create/update PRs. If you are unsure, starting with read-only (contents: read) is the safest, and you can expand later if the workflow fails due to insufficient privileges.

For this specific file, the best way to fix the issue without changing functionality is to add a permissions: block at the workflow root (right below name:) so it applies to all jobs, including the reusable native job. A conservative, minimal and commonly recommended configuration is:

permissions:
  contents: read

If you know that the updater workflow needs to push branches or open PRs, you could instead use:

permissions:
  contents: write
  pull-requests: write

Since we must avoid guessing extra behavior, we’ll implement the minimal safe baseline of contents: read. Concretely, in .github/workflows/update-deps.yml, insert a permissions: block after line 1 (name: Update Dependencies) and before the on: block. No imports or additional definitions are needed.

[loewenheim]

What's with this diff? Only one line has changed.