chore: update gh actions and permissions

Author: oetr

.github/workflows/release.yaml

@@ -9,6 +9,8 @@ on:
 jobs:
   prebuilds:
     name: create prebuilds
+    permissions:
+      contents: read
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
@@ -19,9 +21,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
       - name: node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: "npm"
@@ -35,7 +37,7 @@ jobs:
           npm run prebuild --workspace=@jazzer.js/fuzzer -- ${{ matrix.opts }}
           npm run build --workspace=@jazzer.js/fuzzer -- ${{ matrix.opts }}
       - name: upload
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v7
         with:
           name: native-addon
           path: packages/fuzzer/prebuilds
@@ -49,9 +51,9 @@ jobs:
       contents: write # for creating releases
     steps:
       - name: checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
       - name: node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: "npm"
@@ -61,7 +63,7 @@ jobs:
       - name: build
         run: npm run build
       - name: download prebuilds
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v8
         with:
           name: native-addon
           path: packages/fuzzer/prebuilds

.github/workflows/run-all-tests-main.yaml

@@ -12,8 +12,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: checkout
-        uses: actions/checkout@v3
-      - uses: actions/cache@v3
+        uses: actions/checkout@v6
+      - uses: actions/cache@v5
         id: cache-fuzzer
         with:
           path: |
@@ -23,7 +23,7 @@ jobs:
             hashFiles('packages/fuzzer/CMakeLists.txt',
             'packages/fuzzer/**/*.h', 'packages/fuzzer/**/*.cpp') }}
       - name: node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: "npm"

.github/workflows/run-all-tests-pr.yaml

@@ -4,6 +4,10 @@ on:
     branches: [main]
   merge_group:
   workflow_dispatch:
+
+permissions:
+  contents: read
+
 concurrency:
   group:
     ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -14,9 +18,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
       - name: node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: "npm"
@@ -48,8 +52,8 @@ jobs:
             node: 24
     steps:
       - name: checkout
-        uses: actions/checkout@v3
-      - uses: actions/cache@v3
+        uses: actions/checkout@v6
+      - uses: actions/cache@v5
         id: cache-fuzzer
         with:
           path: |
@@ -59,7 +63,7 @@ jobs:
             hashFiles('packages/fuzzer/CMakeLists.txt',
             'packages/fuzzer/**/*.h', 'packages/fuzzer/**/*.cpp') }}
       - name: node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
           cache: "npm"
@@ -84,10 +88,10 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
       - name: checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
       # Build with node.js 22
       - name: node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: "npm"
@@ -105,7 +109,7 @@ jobs:
       # all in one job to avoid rebuilding
       - name: "node 14"
         if: matrix.os != 'macos-latest'
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v6
         with:
           node-version: 14
       - name: run tests (node 14)
@@ -114,15 +118,15 @@ jobs:
         shell: bash
 
       - name: "node 20"
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v6
         with:
           node-version: 20
       - name: run tests (node 20)
         run: cd end-to-end && npx jest
         shell: bash
 
       - name: "node 24"
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v6
         with:
           node-version: 24
       - name: run tests (node 24)