Update workflows

.github/workflows/build.yml

@@ -32,6 +32,8 @@ jobs:
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Ruby version
         run: ruby -v
       - name: Compiler version
@@ -45,6 +47,8 @@ jobs:
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Ruby version
         run: ruby -v
       - name: Cache cosmocc
@@ -71,6 +75,8 @@ jobs:
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Ruby version
         run: ruby -v
       - name: Build and test

.github/workflows/codeql-analysis.yml

@@ -19,6 +19,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4
         with:

.github/workflows/coverage.yml

@@ -2,6 +2,9 @@ name: Coverage
 
 on: [push]
 
+permissions:
+  contents: read
+
 jobs:
   coverage:
     name: Coverage
@@ -17,6 +20,8 @@ jobs:
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Ruby version
         run: ruby -v
       - name: Compiler version

.github/workflows/ls-lint.yml

@@ -12,6 +12,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: ls-lint/action@v2.3.1
         with:
           config: .github/linters/.ls-lint.yml

.github/workflows/pre-commit-manual.yml

@@ -13,6 +13,8 @@ jobs:
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: j178/prek-action@v1
         with:
           install-only: true

.github/workflows/pre-commit.yml

@@ -13,6 +13,8 @@ jobs:
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: j178/prek-action@v1
         with:
           extra-args: --all-files

.github/workflows/release.yml

@@ -20,6 +20,8 @@ jobs:
     steps:
       - name: "Checkout ${{ github.ref_name }} ( ${{ github.sha }} )"
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Builds
         id: builds
         run: |

.github/workflows/super-linter.yml

@@ -19,6 +19,7 @@ jobs:
         with:
           # Full git history is needed to get a proper list of changed files within `super-linter`
           fetch-depth: 0
+          persist-credentials: false
       - name: Lint Code Base
         uses: super-linter/super-linter/slim@v8.5.0
         env: