add hashes to github action versions

Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>

.github/workflows/assembleFlavors.yml

@@ -4,6 +4,9 @@ on:
     pull_request:
         branches: [ master, stable-* ]
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
     flavor:
         runs-on: ubuntu-latest
@@ -12,9 +15,9 @@ jobs:
             matrix:
                 flavor: [ Generic, Gplay ]
         steps:
-      -   uses: actions/checkout@v3
+            -   uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3
             -   name: set up JDK 11
-          uses: actions/setup-java@v3
+                uses: actions/setup-java@1df8dbefe2a8cbc99770194893dd902763bee34b # v3
                 with:
                     distribution: "temurin"
                     java-version: 11

.github/workflows/autoApproveDependabot.yml

@@ -3,11 +3,14 @@ on:
     pull_request_target:
         branches: [ master, stable-* ]
 
+permissions:
+    pull-requests: write
+
 jobs:
     auto-approve:
         runs-on: ubuntu-latest
         steps:
-            -   uses: hmarr/auto-approve-action@v3.1.0
+            -   uses: hmarr/auto-approve-action@de8ae18c173c131e182d4adf2c874d8d2308a85b # v3.1.0
                 if: github.actor == 'dependabot[bot]' || github.actor == 'dependabot-preview[bot]'
                 with:
                     github-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/check.yml

@@ -4,6 +4,9 @@ on:
     pull_request:
         branches: [ master, stable-* ]
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
     check:
         runs-on: ubuntu-latest
@@ -12,9 +15,9 @@ jobs:
             matrix:
                 task: [ detekt, ktlintCheck ]
         steps:
-            -   uses: actions/checkout@v3
+            -   uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3
             -   name: Set up JDK 11
-                uses: actions/setup-java@v3
+                uses: actions/setup-java@1df8dbefe2a8cbc99770194893dd902763bee34b # v3
                 with:
                     distribution: "temurin"
                     java-version: 11

.github/workflows/gradle-wrapper-validation.yml

@@ -4,10 +4,13 @@ on:
     pull_request:
         branches: [ master, stable-* ]
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
     validation:
         name: "Validation"
         runs-on: ubuntu-latest
         steps:
-            -   uses: actions/checkout@v3
+            -   uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3
-            -   uses: gradle/wrapper-validation-action@v1
+            -   uses: gradle/wrapper-validation-action@55e685c48d84285a5b0418cd094606e199cca3b6 # v1

.github/workflows/qa.yml

@@ -4,6 +4,10 @@ on:
     pull_request:
         branches: [ master, stable-* ]
 
+permissions:
+    pull-requests: write
+    contents: read
+
 jobs:
     qa:
         runs-on: ubuntu-latest
@@ -11,11 +15,11 @@ jobs:
             -   name: Check if secrets are available
                 run: echo "::set-output name=ok::${{ secrets.KS_PASS != '' }}"
                 id: check-secrets
-            -   uses: actions/checkout@v3
+            -   uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3
                 if: ${{ steps.check-secrets.outputs.ok == 'true' }}
             -   name: set up JDK 11
+                uses: actions/setup-java@1df8dbefe2a8cbc99770194893dd902763bee34b # v3
                 if: ${{ steps.check-secrets.outputs.ok == 'true' }}
-                uses: actions/setup-java@v3
                 with:
                     distribution: "temurin"
                     java-version: 11