[OskarEichler]

Summary

Pins both GitHub Actions dependencies to reviewed immutable commits and explicitly limits the workflow token to read-only repository contents.

Security impact

The test workflow currently selects actions/checkout@v6 and ruby/setup-ruby@v1 through mutable refs. If either ref moves unexpectedly or its upstream repository is compromised, changed third-party code can execute in this repository's push and pull-request workflows without a corresponding source change here.

This is rated low urgency because the workflow has no package-publishing step or repository secret, and public fork pull requests do not receive repository secrets. Explicit read-only permissions also remove dependence on repository-level default token settings.

The pinned revisions preserve the currently selected action versions:

• actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 (v6)
• ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b (v1)

I checked all open and closed issues and pull requests and found no existing fix for this workflow boundary.

Verification

• rbenv exec bundle exec rake: 67 examples, 0 failures
• rbenv exec gem build unicode-display_width.gemspec: built unicode-display_width-3.2.0.gem
• Workflow parsed with Ruby/Psych
• All four uses: selectors verified as full 40-character commits
• Both commits resolve in their upstream action repositories
• All eight Ruby files compile on Ruby 4.0.6
• git diff --check passes

Limitations

• Hosted GitHub Actions matrix execution is left to this PR.
• Windows, JRuby, TruffleRuby, and older MRI versions were not run locally.
• This change does not alter runtime gem code.

Breaking changes

None. This changes CI configuration only.

[janlelis]

Thanks!