The template for github/workflows/ci-benchmarks-validate.yml has been updated #661

diff --git a/templates/github/workflows/ci-benchmarks-validate.yml b/templates/github/workflows/ci-benchmarks-validate.yml
index c7626b3..db77f57 100644
--- a/templates/github/workflows/ci-benchmarks-validate.yml
+++ b/templates/github/workflows/ci-benchmarks-validate.yml
@@ -1,3 +1,7 @@
+# Reference
+#    - https://github.com/actions/checkout
+#    - https://github.com/actions/cache
+
 name: benchmarks-validate
 run-name: Validate the benchmarking setup
 
@@ -17,6 +21,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   validate:
     runs-on: ubuntu-latest
@@ -27,16 +33,17 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Install run dependencies
         run: pip install asv  # Some repos also need Nox
 
-      - name: Cache environment directories
-        id: cache-env-dir
-        uses: actions/cache@v4
+      - name: Restore environment cache
+        id: cache-restore
+        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae
         with:
           path: |
             benchmarks/.asv/env
@@ -45,3 +52,14 @@ jobs:
 
       - name: Validate setup
         run: benchmarks/bm_runner.py validate
+
+      - name: Save environment cache
+        # Security: PRs are potentially malformed/malicious, so only allow runs on trunk
+        #  branches to update the cache, to avoid cache poisoning.
+        if: github.event_name == 'push'
+        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae
+        with:
+          path: |
+            benchmarks/.asv/env
+            $CONDA/pkgs
+          key: ${{ steps.cache-restore.outputs.cache-primary-key }}