ci(security): pin action SHAs and least-privilege permissions

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/ci.yml

@@ -2,12 +2,14 @@ name: CLI CI
 on:
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: oven-sh/setup-bun@v2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
       - run: bun install --frozen-lockfile
       - run: bun run format:check
       - run: bun run typecheck

.github/workflows/publish.yml

@@ -2,22 +2,24 @@ name: Publish to npm
 on:
   release:
     types: [published]
+permissions:
+  contents: read
 jobs:
   publish:
     runs-on: ubuntu-latest
     permissions:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v6
-      - uses: oven-sh/setup-bun@v2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
       - run: bun install --frozen-lockfile
       - run: bun run format:check
       - run: bun run typecheck
       - run: bun run lint
       - run: bun run test
       - run: bun run build
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24
           registry-url: https://registry.npmjs.org/

.gitignore

@@ -48,3 +48,10 @@ dev-fixtures/
 
 # Private docs (kept local, not shipped in the public repo or on npm)
 docs/
+DEV_ACCOUNTS.local.json
+selfIdentity.plist
+*.local.json
+*.jks
+*.p8
+google-services.json
+GoogleService-Info.plist