[OskarEichler]

Summary

Pins both third-party actions used by the test workflow to immutable revisions and explicitly limits the workflow token to read-only repository contents.

Severity: LOW. Mutable action channels and repository-default token permissions let future upstream tag movement or configuration changes alter trusted CI behavior without a repository diff. This workflow handles no release credentials and now receives only the permission it needs.

Change

• actions/checkout@v5 → fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
• ruby/setup-ruby@v1 → 95ef2b042f9d7a56d8268cba8559e2842e2ad01b
• workflow-level permissions → contents: read

Major-version comments remain beside the hashes for update tooling and reviewer context.

Verification

• Both commits were resolved from the actions' official repositories at review time.
• The workflow parses successfully with Ruby/Psych.
• Every uses: entry is an immutable 40-character commit.
• git diff --check passes.
• The unchanged runtime passes 224 examples with Rack 2 and 224 examples with Rack 3 on Ruby 4.0.6.

actionlint, the historical Ruby matrix, JRuby/TruffleRuby, and publishing were not exercised locally.

Compatibility and breaking changes

No runtime, dependency, or package behavior changes. Workflow action updates now require deliberate SHA changes.