Pin third-party GitHub Actions to SHAs and limit editor-copy publishing

.github/workflows/archive.yml

@@ -23,15 +23,15 @@ jobs:
     # Note: No caching for this build!
 
     - name: "Update Archive"
-      uses: martinthomson/i-d-template@v1
+      uses: martinthomson/i-d-template@d2ce969b54014edf5671856b6866866c258bf8f5
       env:
         ARCHIVE_FULL: ${{ inputs.archive_full }}
       with:
         make: archive
         token: ${{ github.token }}
 
     - name: "Update GitHub Pages"
-      uses: martinthomson/i-d-template@v1
+      uses: martinthomson/i-d-template@d2ce969b54014edf5671856b6866866c258bf8f5
       with:
         make: gh-archive
         token: ${{ github.token }}

.github/workflows/ghpages.yml

@@ -2,6 +2,8 @@ name: "Update Editor's Copy"
 
 on:
   push:
+    branches:
+    - main
     paths-ignore:
     - README.md
     - CONTRIBUTING.md
@@ -14,6 +16,9 @@ on:
     - LICENSE.md
     - .gitignore
 
+permissions:
+  contents: write
+
 jobs:
   build:
     name: "Update Editor's Copy"
@@ -39,12 +44,12 @@ jobs:
         restore-keys: i-d-
 
     - name: "Build Drafts"
-      uses: martinthomson/i-d-template@v1
+      uses: martinthomson/i-d-template@d2ce969b54014edf5671856b6866866c258bf8f5
       with:
         token: ${{ github.token }}
 
     - name: "Update GitHub Pages"
-      uses: martinthomson/i-d-template@v1
+      uses: martinthomson/i-d-template@d2ce969b54014edf5671856b6866866c258bf8f5
       if: ${{ github.event_name == 'push' }}
       with:
         make: gh-pages

.github/workflows/publish.yml

@@ -40,12 +40,12 @@ jobs:
         restore-keys: i-d-
 
     - name: "Build Drafts"
-      uses: martinthomson/i-d-template@v1
+      uses: martinthomson/i-d-template@d2ce969b54014edf5671856b6866866c258bf8f5
       with:
         token: ${{ github.token }}
 
     - name: "Upload to Datatracker"
-      uses: martinthomson/i-d-template@v1
+      uses: martinthomson/i-d-template@d2ce969b54014edf5671856b6866866c258bf8f5
       with:
         make: upload
       env:

.github/workflows/update.yml

@@ -27,7 +27,7 @@ jobs:
       uses: actions/checkout@v4
 
     - name: "Update Generated Files"
-      uses: martinthomson/i-d-template@v1
+      uses: martinthomson/i-d-template@d2ce969b54014edf5671856b6866866c258bf8f5
       with:
         make: update-files
         token: ${{ github.token }}