From fa4ba60b97da95c7963677921f1b900cd177a449 Mon Sep 17 00:00:00 2001
From: Celeste de Guzman <16906646+CelesteDG@users.noreply.github.com>
Date: Wed, 9 Sep 2026 22:37:56 -0700
Subject: [PATCH] Harden link checker workflow dependencies

Pin third-party actions to immutable release commits and reduce token exposure in the scheduled link checker.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/linkchecker.yml | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/linkchecker.yml b/.github/workflows/linkchecker.yml
index 57a3bf9..d8406ae 100644
--- a/.github/workflows/linkchecker.yml
+++ b/.github/workflows/linkchecker.yml
@@ -13,11 +13,13 @@ on:
 jobs:
   linkChecker:
     permissions:
-      contents: write
+      contents: read
       issues: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+        with:
+          persist-credentials: false
 
       - name: Resolve root-relative links for checking
         run: |
@@ -27,17 +29,17 @@ jobs:
 
       - name: Link Checker
         id: lychee
-        uses: lycheeverse/lychee-action@master
-        env:
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+        uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0
         with:
+          token: ''
           args: --config=.lychee.toml --accept=200,429,403,502,503 --verbose --no-progress './**/*.md'
           fail: true
 
       - name: Create Issue From File
         if: always() && env.lychee_exit_code != 0 && github.event_name != 'pull_request'
-        uses: peter-evans/create-issue-from-file@main
+        uses: peter-evans/create-issue-from-file@fca9117c27cdc29c6c4db3b86c48e4115a786710 # v6.0.0
         with:
+          token: ${{ github.token }}
           title: Link Checker Report
           content-filepath: ./lychee/out.md
           labels: report, automated issue