CI: Harden GHA configuration

.github/dependabot.yml

@@ -0,0 +1,7 @@
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"      # Location of your workflow files
+    schedule:
+      interval: "weekly"  # Options: daily, weekly, monthly

.github/workflows/asv.yml

@@ -1,6 +1,8 @@
 # This workflow checks that any added benchmarks *run* on the latest Matplotlib
 # release. It does _not_ update any results.
 name: Benchmark Check
+permissions:
+  contents: read
 on: [push, pull_request]
 
 jobs:
@@ -9,19 +11,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
+        with:
+          persist-credentials: false
 
       - name: Set up Python 3
         uses: actions/setup-python@v1
         with:
-          python-version: 3.8
+          python-version: 3.12
 
       - name: Install asv
         run: pip3 install asv matplotlib
 
       - name: Run asv
         run: |
           asv machine --yes
-          asv dev
+          asv run
 
       - name: Check benchmarks.json is up to date
         run: |

.github/workflows/gh-pages.yml

@@ -1,4 +1,6 @@
 name: GitHub Pages
+permissions:
+  contents: read
 
 on:
   push:
@@ -10,6 +12,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
+        with:
+          persist-credentials: false
 
       - name: Set up Python 3
         uses: actions/setup-python@v1
@@ -23,7 +27,7 @@ jobs:
         run: asv publish
 
       - name: Deploy
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 # v3
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./html

.github/workflows/reviewdog.yml

@@ -1,4 +1,6 @@
 name: Linting
+permissions:
+  contents: read
 on: [pull_request]
 
 jobs:
@@ -7,11 +9,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
+        with:
+          persist-credentials: false
 
       - name: Set up Python 3
         uses: actions/setup-python@v1
         with:
-          python-version: 3.8
+          python-version: 3.12
 
       - name: Install flake8
         run: pip3 install flake8