From c82bf2f345c571efec16158516b5453ee452b0cf Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 17 Sep 2026 12:13:02 +0000
Subject: [PATCH 1/2] Bump the actions group with 11 updates

Bumps the actions group with 11 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `2` | `7` |
| [actions/cache](https://github.com/actions/cache) | `2` | `6` |
| [game-ci/unity-builder](https://github.com/game-ci/unity-builder) | `2.1.2` | `6.0.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `2.3.1` | `7.0.1` |
| [actions/setup-python](https://github.com/actions/setup-python) | `3` | `7` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `3.0.2` | `8.0.1` |
| [huggingface/doc-builder/.github/workflows/build_main_documentation.yml](https://github.com/huggingface/doc-builder) | `90b4ee2c10b81b5c1a6367c4e6fc9e2fb510a7e3` | `17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169` |
| [huggingface/doc-builder/.github/workflows/build_pr_documentation.yml](https://github.com/huggingface/doc-builder) | `90b4ee2c10b81b5c1a6367c4e6fc9e2fb510a7e3` | `17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169` |
| [huggingface/doc-builder/.github/workflows/delete_doc_comment.yml](https://github.com/huggingface/doc-builder) | `90b4ee2c10b81b5c1a6367c4e6fc9e2fb510a7e3` | `17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169` |
| [pypa/cibuildwheel](https://github.com/pypa/cibuildwheel) | `2.10.1` | `4.2.1` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.5.1` | `1.14.2` |


Updates `actions/checkout` from 2 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](https://github.com/actions/checkout/compare/v2...v7)

Updates `actions/cache` from 2 to 6
- [Release notes](https://github.com/actions/cache/releases)
- [Commits](https://github.com/actions/cache/compare/v2...v6)

Updates `game-ci/unity-builder` from 2.1.2 to 6.0.0
- [Release notes](https://github.com/game-ci/unity-builder/releases)
- [Commits](https://github.com/game-ci/unity-builder/compare/9f79830454d37cd9e70c4c3b73d26c06bcce2b2a...eb1b9fba120c6e62c9fb7a7a81d6c107ce004c45)

Updates `actions/upload-artifact` from 2.3.1 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v2.3.1...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a)

Updates `actions/setup-python` from 3 to 7
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v3...v7)

Updates `actions/download-artifact` from 3.0.2 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/9bc31d5ccc31df68ecc42ccf4149144866c47d8a...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c)

Updates `huggingface/doc-builder/.github/workflows/build_main_documentation.yml` from 90b4ee2c10b81b5c1a6367c4e6fc9e2fb510a7e3 to 17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169
- [Release notes](https://github.com/huggingface/doc-builder/releases)
- [Changelog](https://github.com/huggingface/doc-builder/blob/main/RELEASE.md)
- [Commits](https://github.com/huggingface/doc-builder/compare/90b4ee2c10b81b5c1a6367c4e6fc9e2fb510a7e3...17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169)

Updates `huggingface/doc-builder/.github/workflows/build_pr_documentation.yml` from 90b4ee2c10b81b5c1a6367c4e6fc9e2fb510a7e3 to 17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169
- [Release notes](https://github.com/huggingface/doc-builder/releases)
- [Changelog](https://github.com/huggingface/doc-builder/blob/main/RELEASE.md)
- [Commits](https://github.com/huggingface/doc-builder/compare/90b4ee2c10b81b5c1a6367c4e6fc9e2fb510a7e3...17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169)

Updates `huggingface/doc-builder/.github/workflows/delete_doc_comment.yml` from 90b4ee2c10b81b5c1a6367c4e6fc9e2fb510a7e3 to 17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169
- [Release notes](https://github.com/huggingface/doc-builder/releases)
- [Changelog](https://github.com/huggingface/doc-builder/blob/main/RELEASE.md)
- [Commits](https://github.com/huggingface/doc-builder/compare/90b4ee2c10b81b5c1a6367c4e6fc9e2fb510a7e3...17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169)

Updates `pypa/cibuildwheel` from 2.10.1 to 4.2.1
- [Release notes](https://github.com/pypa/cibuildwheel/releases)
- [Changelog](https://github.com/pypa/cibuildwheel/blob/main/docs/changelog.md)
- [Commits](https://github.com/pypa/cibuildwheel/compare/v2.10.1...v4.2.1)

Updates `pypa/gh-action-pypi-publish` from 1.5.1 to 1.14.2
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](https://github.com/pypa/gh-action-pypi-publish/compare/v1.5.1...v1.14.2)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/cache
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: game-ci/unity-builder
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/setup-python
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: huggingface/doc-builder/.github/workflows/build_main_documentation.yml
  dependency-version: 17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169
  dependency-type: direct:production
  dependency-group: actions
- dependency-name: huggingface/doc-builder/.github/workflows/build_pr_documentation.yml
  dependency-version: 17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169
  dependency-type: direct:production
  dependency-group: actions
- dependency-name: huggingface/doc-builder/.github/workflows/delete_doc_comment.yml
  dependency-version: 17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169
  dependency-type: direct:production
  dependency-group: actions
- dependency-name: pypa/cibuildwheel
  dependency-version: 4.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.14.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/build-push-unity.yml       | 16 ++++++++--------
 .github/workflows/build_documentation.yml    |  2 +-
 .github/workflows/build_pr_documentation.yml |  2 +-
 .github/workflows/delete_doc_comment.yml     |  2 +-
 .github/workflows/pip.yml                    |  4 ++--
 .github/workflows/quality.yml                |  4 ++--
 .github/workflows/tests-no-deps.yml          |  6 +++---
 .github/workflows/tests.yml                  |  6 +++---
 .github/workflows/wheels.yml                 | 16 ++++++++--------
 9 files changed, 29 insertions(+), 29 deletions(-)

diff --git a/.github/workflows/build-push-unity.yml b/.github/workflows/build-push-unity.yml
index 4b45db30..89cf5402 100644
--- a/.github/workflows/build-push-unity.yml
+++ b/.github/workflows/build-push-unity.yml
@@ -28,13 +28,13 @@ jobs:
           - StandaloneLinux64 # Build a Linux 64-bit standalone.
           # - WebGL # WebGL.
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           lfs: true
 
       - name: Caching Unity Library
-        uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace  # v2
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: integrations/Unity/simulate-unity/Library
           key: Library-Simulate
@@ -43,7 +43,7 @@ jobs:
             Library-
 
       - name: Build Unity Simulate
-        uses: game-ci/unity-builder@9f79830454d37cd9e70c4c3b73d26c06bcce2b2a  # v2
+        uses: game-ci/unity-builder@eb1b9fba120c6e62c9fb7a7a81d6c107ce004c45  # v6.0.0
         env:
           UNITY_LICENSE: ${{ secrets.UNITY_LICENSE }}
         with:
@@ -57,7 +57,7 @@ jobs:
           cd ${{ github.workspace }}/integrations/Unity/builds/
           tar -cvzf ${{ github.workspace }}/compressed_builds/${{ matrix.targetPlatform }}.tar.gz ./${{ matrix.targetPlatform }}
 
-      - uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2  # v2
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: Build-${{ matrix.targetPlatform }}
           path: ${{ github.workspace }}/compressed_builds/${{ matrix.targetPlatform }}.tar.gz
@@ -66,7 +66,7 @@ jobs:
   #   name: Simple build and push
   #   runs-on: ubuntu-latest
   #   steps:
-  #     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+  #     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
   #       with:
   #         fetch-depth: 0
   #         lfs: true
@@ -78,7 +78,7 @@ jobs:
   #         tar -cvzf ${{ github.workspace }}/builds/Standalone.tar.gz ./simulate_godot
 
 
-  #     - uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2  # v2
+  #     - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
   #       with:
   #         name: Build-Standalone
   #         path: ./builds/Standalone.tar.gz
@@ -90,11 +90,11 @@ jobs:
     # if: github.event_name == 'release' && github.event.action == 'published'
 
     steps:
-      - uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c  # v4
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.x"
 
-      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a  # v3
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           # name: artifact
           path: builds
diff --git a/.github/workflows/build_documentation.yml b/.github/workflows/build_documentation.yml
index 2ed0efbb..67a18e2a 100644
--- a/.github/workflows/build_documentation.yml
+++ b/.github/workflows/build_documentation.yml
@@ -9,7 +9,7 @@ on:
 
 jobs:
    build:
-    uses: huggingface/doc-builder/.github/workflows/build_main_documentation.yml@90b4ee2c10b81b5c1a6367c4e6fc9e2fb510a7e3  # main
+    uses: huggingface/doc-builder/.github/workflows/build_main_documentation.yml@17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169  # main
     with:
       commit_sha: ${{ github.sha }}
       package: simulate
diff --git a/.github/workflows/build_pr_documentation.yml b/.github/workflows/build_pr_documentation.yml
index 373ed48a..e0e861db 100644
--- a/.github/workflows/build_pr_documentation.yml
+++ b/.github/workflows/build_pr_documentation.yml
@@ -9,7 +9,7 @@ concurrency:
 
 jobs:
   build:
-    uses: huggingface/doc-builder/.github/workflows/build_pr_documentation.yml@90b4ee2c10b81b5c1a6367c4e6fc9e2fb510a7e3  # main
+    uses: huggingface/doc-builder/.github/workflows/build_pr_documentation.yml@17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169  # main
     with:
       commit_sha: ${{ github.event.pull_request.head.sha }}
       pr_number: ${{ github.event.number }}
diff --git a/.github/workflows/delete_doc_comment.yml b/.github/workflows/delete_doc_comment.yml
index e0ba6487..83ab2115 100644
--- a/.github/workflows/delete_doc_comment.yml
+++ b/.github/workflows/delete_doc_comment.yml
@@ -7,7 +7,7 @@ on:
 
 jobs:
   delete:
-    uses: huggingface/doc-builder/.github/workflows/delete_doc_comment.yml@90b4ee2c10b81b5c1a6367c4e6fc9e2fb510a7e3  # main
+    uses: huggingface/doc-builder/.github/workflows/delete_doc_comment.yml@17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169  # main
     with:
       pr_number: ${{ github.event.number }}
       package: simulate
\ No newline at end of file
diff --git a/.github/workflows/pip.yml b/.github/workflows/pip.yml
index a12139c6..bcab360e 100644
--- a/.github/workflows/pip.yml
+++ b/.github/workflows/pip.yml
@@ -22,9 +22,9 @@ jobs:
     runs-on: ${{ matrix.platform }}
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v7
 
-    - uses: actions/setup-python@v4
+    - uses: actions/setup-python@v7
       with:
         python-version: ${{ matrix.python-version }}
 
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index a513b4b5..c72fcfcd 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -6,9 +6,9 @@ jobs:
   quality:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v7
     - name: Set up Python 3.8
-      uses: actions/setup-python@v3
+      uses: actions/setup-python@v7
       with:
         python-version: 3.8
     - name: Install Python dependencies
diff --git a/.github/workflows/tests-no-deps.yml b/.github/workflows/tests-no-deps.yml
index 24b3a743..de3e9b73 100644
--- a/.github/workflows/tests-no-deps.yml
+++ b/.github/workflows/tests-no-deps.yml
@@ -17,14 +17,14 @@ jobs:
             vtk-version: '9.0.3'
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c  # v4
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
 
-      - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c  # v3
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: ~/.cache/pip
           key: Python-${{ runner.os }}-${{ matrix.python-version }}-${{ matrix.vtk-version }}-${{ hashFiles('setup.py') }}-${{ hashFiles('requirements_test.txt') }}
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 03a170dc..fe5d2db8 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -21,14 +21,14 @@ jobs:
             vtk-version: 'latest'
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
 
-      - uses: actions/cache@v3
+      - uses: actions/cache@v6
         with:
           path: ~/.cache/pip
           key: Python-${{ runner.os }}-${{ matrix.python-version }}-${{ matrix.vtk-version }}-${{ hashFiles('setup.py') }}-${{ hashFiles('requirements_test.txt') }}
diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml
index a12aa879..46231e0b 100644
--- a/.github/workflows/wheels.yml
+++ b/.github/workflows/wheels.yml
@@ -19,7 +19,7 @@ jobs:
     name: Build SDist
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
     - name: Build SDist
       run: pipx run build --sdist
@@ -27,7 +27,7 @@ jobs:
     - name: Check metadata
       run: pipx run twine check dist/*
 
-    - uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5  # v3
+    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         path: dist/*.tar.gz
 
@@ -41,9 +41,9 @@ jobs:
         os: [ubuntu-20.04, windows-2019, macos-11]
 
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-    - uses: pypa/cibuildwheel@v2.10.1
+    - uses: pypa/cibuildwheel@v4.2.1
       env:
         CIBW_ARCHS_MACOS: auto universal2
         CIBW_SKIP: cp311-* *-win32 pp38-* pp39-* *_i686 *-musllinux_* cp38-*-universal2
@@ -54,7 +54,7 @@ jobs:
       shell: bash
 
     - name: Upload wheels
-      uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5  # v3
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         path: wheelhouse/*.whl
 
@@ -66,16 +66,16 @@ jobs:
     if: github.event_name == 'release' && github.event.action == 'published'
 
     steps:
-    - uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c  # v4
+    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
       with:
         python-version: "3.x"
 
-    - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a  # v3
+    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
       with:
         name: artifact
         path: dist
 
-    - uses: pypa/gh-action-pypi-publish@v1.5.1
+    - uses: pypa/gh-action-pypi-publish@v1.14.2
       with:
         user: thomwolf
         password: ${{ secrets.pypi_password }}
\ No newline at end of file

From bc535ec8a4db9e0e0e477f35b31a01b5dcec0d3c Mon Sep 17 00:00:00 2001
From: "hf-security-analysis[bot]"
 <265538906+hf-security-analysis[bot]@users.noreply.github.com>
Date: Thu, 17 Sep 2026 15:12:49 +0200
Subject: [PATCH 2/2] fix(ci): harden workflow files flagged on #377 (#378)

Co-authored-by: hf-security-analysis[bot] <265538906+hf-security-analysis[bot]@users.noreply.github.com>
---
 .github/workflows/build-push-unity.yml |  8 +++++++-
 .github/workflows/pip.yml              |  8 ++++++--
 .github/workflows/quality.yml          |  8 ++++++--
 .github/workflows/tests-no-deps.yml    |  4 ++++
 .github/workflows/tests.yml            | 10 +++++++---
 .github/workflows/wheels.yml           | 11 +++++++++--
 6 files changed, 39 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/build-push-unity.yml b/.github/workflows/build-push-unity.yml
index 89cf5402..f73041a2 100644
--- a/.github/workflows/build-push-unity.yml
+++ b/.github/workflows/build-push-unity.yml
@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   buildForAllSupportedPlatforms:
+    permissions:
+      contents: read
     name: Build ${{ matrix.targetPlatform }}
     runs-on: ubuntu-latest
     strategy:
@@ -84,10 +88,11 @@ jobs:
   #         path: ./builds/Standalone.tar.gz
 
   PushToHub:
+    permissions: {}
     name: Upload if release
     needs: [buildForAllSupportedPlatforms]
     runs-on: ubuntu-latest
-    # if: github.event_name == 'release' && github.event.action == 'published'
+    if: github.event_name == 'release' && github.event.action == 'published'
 
     steps:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
@@ -100,6 +105,7 @@ jobs:
           path: builds
 
       - name: Push builds to Hub
+        if: github.event_name == 'release' && github.event.action == 'published'
         env:
           HF_TOKEN: ${{ secrets.UNITY_BUILD_PUSH }}
           HF_USERNAME: thomwolf
diff --git a/.github/workflows/pip.yml b/.github/workflows/pip.yml
index bcab360e..0eb108de 100644
--- a/.github/workflows/pip.yml
+++ b/.github/workflows/pip.yml
@@ -11,8 +11,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -22,9 +26,9 @@ jobs:
     runs-on: ${{ matrix.platform }}
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-    - uses: actions/setup-python@v7
+    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: ${{ matrix.python-version }}
 
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index c72fcfcd..c2cbef32 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -2,13 +2,17 @@ name: Quality Check
 
 on: [pull_request]
 
+permissions: {}
+
 jobs:
   quality:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Set up Python 3.8
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: 3.8
     - name: Install Python dependencies
diff --git a/.github/workflows/tests-no-deps.yml b/.github/workflows/tests-no-deps.yml
index de3e9b73..8b9b8d3c 100644
--- a/.github/workflows/tests-no-deps.yml
+++ b/.github/workflows/tests-no-deps.yml
@@ -5,8 +5,12 @@ on: [pull_request]
 env:
   HF_HOME: ~/hf_cache
 
+permissions: {}
+
 jobs:
   run-tests:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
 
     strategy:
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index fe5d2db8..098eef2e 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -5,8 +5,12 @@ on: [pull_request]
 env:
   HF_HOME: ~/hf_cache
 
+permissions: {}
+
 jobs:
   run-tests:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
 
     strategy:
@@ -21,14 +25,14 @@ jobs:
             vtk-version: 'latest'
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
 
-      - uses: actions/cache@v6
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/pip
           key: Python-${{ runner.os }}-${{ matrix.python-version }}-${{ matrix.vtk-version }}-${{ hashFiles('setup.py') }}-${{ hashFiles('requirements_test.txt') }}
diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml
index 46231e0b..b35e11c0 100644
--- a/.github/workflows/wheels.yml
+++ b/.github/workflows/wheels.yml
@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build_sdist:
+    permissions:
+      contents: read
     name: Build SDist
     runs-on: ubuntu-latest
     steps:
@@ -33,6 +37,8 @@ jobs:
 
 
   build_wheels:
+    permissions:
+      contents: read
     name: Wheels on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
     strategy:
@@ -43,7 +49,7 @@ jobs:
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-    - uses: pypa/cibuildwheel@v4.2.1
+    - uses: pypa/cibuildwheel@e090b81e30c4d855ea63bf4b6e59204c09a101ae # v4.2.1
       env:
         CIBW_ARCHS_MACOS: auto universal2
         CIBW_SKIP: cp311-* *-win32 pp38-* pp39-* *_i686 *-musllinux_* cp38-*-universal2
@@ -60,6 +66,7 @@ jobs:
 
 
   upload_all:
+    permissions: {}
     name: Upload if release
     needs: [build_wheels, build_sdist]
     runs-on: ubuntu-latest
@@ -75,7 +82,7 @@ jobs:
         name: artifact
         path: dist
 
-    - uses: pypa/gh-action-pypi-publish@v1.14.2
+    - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
       with:
         user: thomwolf
         password: ${{ secrets.pypi_password }}
\ No newline at end of file