chore(ci): Harden Workflows And Pin Actions

.github/workflows/publish-plugins.yml

@@ -10,6 +10,9 @@ on:
       - 'scripts/publish-plugins.sh'
       - '.github/workflows/publish-plugins.yml'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}
   cancel-in-progress: true
@@ -20,17 +23,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           token: ${{ secrets.REPO_SCOPED_TOKEN }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: '20'
+          node-version: '24'
 
       - name: Install Dependencies
-        run: npm install --omit=dev --ignore-scripts
+        run: npm ci --omit=dev --ignore-scripts
 
       - name: Configure Git
         run: |