ci: update workflows

Signed-off-by: Henry Gressmann <mail@henrygressmann.de>

Author: explodingcamera

.github/workflows/audit.yaml.disable

@@ -22,6 +22,8 @@ jobs:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions-rust-lang/audit@v1
         name: Audit Rust Dependencies

.github/workflows/container.yaml

@@ -21,9 +21,11 @@ jobs:
 
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # @v3
       - name: Extract Semver
         id: semver
         env:
@@ -32,7 +34,7 @@ jobs:
           SEMVER_VERSION=$(echo "$INPUT_TAG" | sed -E 's/liwan-v//')
           echo "SEMVER_VERSION=${SEMVER_VERSION}" >> "$GITHUB_OUTPUT"
       - name: Setup Docker Metadata
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # @v5
         id: meta
         with:
           images: ghcr.io/${{ github.actor }}/liwan
@@ -42,13 +44,13 @@ jobs:
             type=semver,pattern={{major}},value=${{ steps.semver.outputs.SEMVER_VERSION }}
             type=raw,edge
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # @v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build and push Docker images
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # @v6
         with:
           context: .
           file: ./scripts/Dockerfile

.github/workflows/release.yaml

@@ -11,10 +11,10 @@ jobs:
       contents: write
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: taiki-e/create-gh-release-action@v1.9.1
+      - uses: taiki-e/create-gh-release-action@26b80501670402f1999aff4b934e1574ef2d3705 # @v1.9.1
         with:
           changelog: CHANGELOG.md
           allow-missing-changelog: true
@@ -24,20 +24,23 @@ jobs:
 
   build-web:
     runs-on: ubuntu-24.04
+    permissions:
+      contents: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # @v2
         with:
           bun-version: latest
+          no-cache: true
       - name: Build web project
         run: |
           bun install
           bun run build
         working-directory: ./web
       - name: Upload web assets
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: web-dist
           path: ./web/dist
@@ -61,15 +64,17 @@ jobs:
 
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: actions/download-artifact@v5
+      - uses: actions/download-artifact@v6
         with:
           name: web-dist
           path: ./web/dist
-      - uses: actions-rust-lang/setup-rust-toolchain@v1.15.2
-      - uses: taiki-e/upload-rust-binary-action@v1.27.0
+      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # @v1.15.2
+        with:
+          cache: false
+      - uses: taiki-e/upload-rust-binary-action@3962470d6e7f1993108411bc3f75a135ec67fc8c # @v1.27.0
         with:
           bin: liwan
           target: ${{ matrix.target }}

.github/workflows/test-web.yaml

@@ -16,11 +16,13 @@ on:
 jobs:
   test:
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # @v2
         with:
           bun-version: latest
       - name: Build web project

.github/workflows/test.yaml

@@ -13,6 +13,8 @@ on:
 
 jobs:
   test:
+    permissions:
+      contents: read
     strategy:
       matrix:
         os:
@@ -21,13 +23,13 @@ jobs:
     name: Run tests on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: actions-rust-lang/setup-rust-toolchain@v1.15.2
+      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # @v1.15.2
         with:
           components: clippy, rustfmt
-      - uses: Swatinem/rust-cache@v2.8.1
+      - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # @v2.8.2
       - run: mkdir ./web/dist
       - name: Run tests
         run: cargo test --all --all-features

scripts/screenshot/bun.lockb

@@ -4,6 +4,6 @@
 	"type": "module",
 	"devDependencies": {
 		"@types/bun": "latest",
-		"capture-website": "^4.2.0"
+		"capture-website": "^5.1.0"
 	}
 }