Fix github CI that was accidentally overridden.

PiperOrigin-RevId: 546422214

.github/workflows/ci.yaml

@@ -16,6 +16,9 @@
 
 name: CI
 
+# Declare default permissions as read only.
+permissions: read-all
+
 # https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#on
 on:
   push:
@@ -33,32 +36,32 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        test-type: [CI, SAMPLES]
+        test-target: ['default', 'samples']
         os: [macos-latest, ubuntu-latest]
 
     runs-on: ${{ matrix.os }}
 
     steps:
       - name: Setup Java
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@5ffc13f4174014e2d4d4572b3d74c3fa61aeb2c2 # v3.11.0
         with:
           java-version: '11'
           distribution: 'zulu'
           java-package: jdk
 
       - name: Checkout current commit
-        uses: actions/checkout@v3
+        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
 
       - name: Cache Bazel repositories
-        uses: actions/cache@v3
+        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
         with:
           path: ~/bazel-repository-cache
           key: bazel-repositories-${{hashFiles('**/WORKSPACE', '**.bzl')}}
           restore-keys: |
             bazel-repositories-
 
       - name: Cache Bazel results
-        uses: actions/cache@v3
+        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
         with:
           path: ~/bazel-action-cache
           key: bazel-actions-${{runner.os}}-${{github.sha}}
@@ -72,4 +75,8 @@ jobs:
           echo "build --verbose_failures" >> ~/.bazelrc
           bazel info
       - name: Run tests
-        run: ./build_test.sh ${{ matrix['test-type'] }}
+        if: matrix.test-target == 'default'
+        run: ./build_test.sh CI
+      - name: Run samples tests
+        if: matrix.test-target == 'samples'
+        run: ./build_test_samples.sh CI