ci(template): Harden workflows (#600)

* ci(template): Fix superfluous-actions audit

* ci(template): Fix excessive-permissions audits

Author: Techassi

template/.github/workflows/build.yaml.j2

@@ -83,9 +83,8 @@ jobs:
           submodules: recursive
 
       - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} toolchain
-        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b
-        with:
-          toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
+        shell: bash
+        run: rustup toolchain install "RUST_TOOLCHAIN_VERSION"
 
       - name: Setup Rust Cache
         uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
@@ -160,9 +159,8 @@ jobs:
         uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31.5.2
 
       - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} Toolchain
-        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b
-        with:
-          toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
+        shell: bash
+        run: rustup toolchain install "RUST_TOOLCHAIN_VERSION"
 
       - name: Build Container Image
         id: build

template/.github/workflows/integration-test.yml

@@ -23,6 +23,8 @@ on:
       test:
         description: Name of the test. Only used of test-mode is `custom`
 
+permissions: {}
+
 jobs:
   test:
     name: Run Integration Test

template/.github/workflows/pr_prek.yaml.j2

@@ -5,12 +5,13 @@ on:
   pull_request:
   merge_group:
 
+permissions: {}
+
 env:
   CARGO_TERM_COLOR: always
   NIX_PKG_MANAGER_VERSION: "{[ nix_pkg_manager_version }]"
   RUST_TOOLCHAIN_VERSION: "{[ rust_nightly_version }]"
   HADOLINT_VERSION: "{[ hadolint_version }]"
-  PYTHON_VERSION: "{[ python_version }]"
   JINJA2_CLI_VERSION: "{[ jinja2_cli_version }]"
 
 jobs:
@@ -29,7 +30,6 @@ jobs:
           fetch-depth: 0
       - uses: stackabletech/actions/run-prek@a14cbd08d9e034e2361ea9205b32aff0491885db # v0.15.0
         with:
-          python-version: ${{ env.PYTHON_VERSION }}
           rust: ${{ env.RUST_TOOLCHAIN_VERSION }}
           hadolint: ${{ env.HADOLINT_VERSION }}
           nix: ${{ env.NIX_PKG_MANAGER_VERSION }}