Merge pull request #4299 from facebook/ga_harden

Improved Github Actions scorecards

.github/workflows/android-ndk-build.yml

@@ -6,6 +6,8 @@ on:
   push:
     branches: [ actionsTest, '*ndk*' ]
 
+permissions: read-all
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -14,13 +16,13 @@ jobs:
     - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # tag=v4.1.1
 
     - name: Set up JDK 17
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
       with:
         java-version: '17'
         distribution: 'temurin'
 
     - name: Setup Android SDK
-      uses: android-actions/setup-android@v3
+      uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3.2.2
 
     - name: Install Android NDK
       run: |

.github/workflows/dev-short-tests.yml

@@ -97,7 +97,7 @@ jobs:
     - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # tag=v4.1.1
       with:
         path: "${{ env.SRC_DIR }}"
-    - uses: ilammy/msvc-dev-cmd@v1
+    - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
       if: ${{ matrix.generator == 'NMake Makefiles' }}
     - name: cmake build on a source directory with spaces
       run: |
@@ -722,4 +722,4 @@ jobs:
     - name: make check
       run: |
         source /opt/intel/oneapi/setvars.sh
-        make CC=icx check
+        make CC=icx check