harden github actions script Android NDK Build

diff --git a/.github/workflows/android-ndk-build.yml b/.github/workflows/android-ndk-build.yml
index c77d5f0d1732c68ef0fe58e45d2012ee16142c22..175add4ff9cc0adaa700f0440140dfc283c2b4e6 100644 (file)
--- a/.github/workflows/android-ndk-build.yml
+++ b/.github/workflows/android-ndk-build.yml
@@ -6,6 +6,8 @@ on:
   push:
     branches: [ actionsTest, '*ndk*' ]
 
+permissions: read-all
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -14,13 +16,13 @@ jobs:
     - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # tag=v4.1.1
 
     - name: Set up JDK 17
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
       with:
         java-version: '17'
         distribution: 'temurin'
 
     - name: Setup Android SDK
-      uses: android-actions/setup-android@v3
+      uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3.2.2
 
     - name: Install Android NDK
       run: |