From 55ef8e17289859590a5533c16cee3b229c1cee2e Mon Sep 17 00:00:00 2001
From: John Bampton <jbampton@gmail.com>
Date: Wed, 18 Mar 2026 17:57:05 +1000
Subject: [PATCH 1/2] Update workflows

---
 .github/workflows/build.yml             | 6 ++++++
 .github/workflows/codeql-analysis.yml   | 2 ++
 .github/workflows/coverage.yml          | 5 +++++
 .github/workflows/ls-lint.yml           | 2 ++
 .github/workflows/pre-commit-manual.yml | 2 ++
 .github/workflows/pre-commit.yml        | 2 ++
 .github/workflows/release.yml           | 2 ++
 .github/workflows/super-linter.yml      | 1 +
 8 files changed, 22 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a0ddc0504..24dda549f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -32,6 +32,8 @@ jobs:
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Ruby version
         run: ruby -v
       - name: Compiler version
@@ -45,6 +47,8 @@ jobs:
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Ruby version
         run: ruby -v
       - name: Cache cosmocc
@@ -71,6 +75,8 @@ jobs:
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Ruby version
         run: ruby -v
       - name: Build and test
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 4b9d2e09b..3ba297119 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -19,6 +19,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4
         with:
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 8848e68cc..937e7a1ef 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -2,6 +2,9 @@ name: Coverage
 
 on: [push]
 
+permissions:
+  contents: read
+
 jobs:
   coverage:
     name: Coverage
@@ -17,6 +20,8 @@ jobs:
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Ruby version
         run: ruby -v
       - name: Compiler version
diff --git a/.github/workflows/ls-lint.yml b/.github/workflows/ls-lint.yml
index 3002e2dba..bce70fd5b 100644
--- a/.github/workflows/ls-lint.yml
+++ b/.github/workflows/ls-lint.yml
@@ -12,6 +12,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: ls-lint/action@v2.3.1
         with:
           config: .github/linters/.ls-lint.yml
diff --git a/.github/workflows/pre-commit-manual.yml b/.github/workflows/pre-commit-manual.yml
index d984b2235..0196260a4 100644
--- a/.github/workflows/pre-commit-manual.yml
+++ b/.github/workflows/pre-commit-manual.yml
@@ -13,6 +13,8 @@ jobs:
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: j178/prek-action@v1
         with:
           install-only: true
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 63e3a7e90..c35679fe6 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -13,6 +13,8 @@ jobs:
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: j178/prek-action@v1
         with:
           extra-args: --all-files
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c9e22856a..cf849c6df 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,6 +20,8 @@ jobs:
     steps:
       - name: "Checkout ${{ github.ref_name }} ( ${{ github.sha }} )"
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Builds
         id: builds
         run: |
diff --git a/.github/workflows/super-linter.yml b/.github/workflows/super-linter.yml
index 5dc373e4a..c26bb56f2 100644
--- a/.github/workflows/super-linter.yml
+++ b/.github/workflows/super-linter.yml
@@ -19,6 +19,7 @@ jobs:
         with:
           # Full git history is needed to get a proper list of changed files within `super-linter`
           fetch-depth: 0
+          persist-credentials: false
       - name: Lint Code Base
         uses: super-linter/super-linter/slim@v8.5.0
         env:

From 80d84188fd4b956fcc9cc35be0031dfe88fb6525 Mon Sep 17 00:00:00 2001
From: John Bampton <jbampton@gmail.com>
Date: Wed, 18 Mar 2026 17:57:33 +1000
Subject: [PATCH 2/2] pre-commit bump Node.js

---
 .pre-commit-config.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 4ef1033cf..ae6fb7014 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -3,7 +3,7 @@
 default_stages: [pre-commit, pre-push]
 default_language_version:
   python: python3
-  node: 24.11.1
+  node: 24.14.0
 minimum_pre_commit_version: "3.2.0"
 exclude: "^tools/lrama/"
 repos: