ci: apply zizmor recommendations (#293)

chgl · Dec 31, 2024 · 6fab7f2 · 6fab7f2
1 parent 7708bde
commit 6fab7f2
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 3 deletions.
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -8,7 +8,8 @@ on:
   pull_request:
     branches: [master]
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   build:
@@ -69,6 +70,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Download image
         uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8

diff --git a/.github/workflows/daily-trivy-scan.yaml b/.github/workflows/daily-trivy-scan.yaml
@@ -4,7 +4,8 @@ on:
     - cron: "0 8 * * *"
 
 # Declare default permissions as read only.
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   scan:

diff --git a/.github/workflows/scorecard.yaml b/.github/workflows/scorecard.yaml
@@ -15,7 +15,8 @@ on:
     branches: ["master"]
 
 # Declare default permissions as read only.
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   analysis: