ci(actions): Pin action versions

.github/workflows/phpunit-mariadb.yml

@@ -107,6 +107,7 @@ jobs:
       - name: Checkout teams dependency
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           repository: nextcloud/circles
           ref: ${{ matrix.server-versions }}
           path: apps/circles

.github/workflows/phpunit-mysql.yml

@@ -105,6 +105,7 @@ jobs:
       - name: Checkout teams dependency
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           repository: nextcloud/circles
           ref: ${{ matrix.server-versions }}
           path: apps/circles

.github/workflows/phpunit-oci.yml

@@ -117,6 +117,7 @@ jobs:
       - name: Checkout teams dependency
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           repository: nextcloud/circles
           ref: ${{ matrix.server-versions }}
           path: apps/circles

.github/workflows/phpunit-pgsql.yml

@@ -108,6 +108,7 @@ jobs:
       - name: Checkout teams dependency
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           repository: nextcloud/circles
           ref: ${{ matrix.server-versions }}
           path: apps/circles

.github/workflows/phpunit-sqlite.yml

@@ -97,13 +97,15 @@ jobs:
       - name: Checkout teams app
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           repository: nextcloud/circles
           ref: ${{ matrix.server-versions }}
           path: apps/circles
 
       - name: Checkout analytics app
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           repository: rello/analytics
           ref: master
           path: apps/analytics

.github/workflows/playwright.yml

@@ -5,13 +5,18 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     timeout-minutes: 60
     runs-on: ubuntu-latest
     steps:
       - name: Checkout app
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Check composer.json
         id: check_composer
@@ -49,7 +54,7 @@ jobs:
       - name: Run Playwright tests
         run: npx playwright test
 
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         if: always()
         with:
           name: playwright-report