ci: add workflow permissions

.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
         branches:
             - main
 
+permissions:
+    contents: read
+
 jobs:
     lint:
         name: Lint
@@ -19,13 +22,10 @@ jobs:
               uses: actions/checkout@v5
 
             - name: Set up Rust toolchain
-              run: rustup toolchain install stable --no-self-update --profile default --target wasm32-unknown-unknown
-
-            - name: Set up Rust cache
-              uses: swatinem/rust-cache@v2
+              uses: actions-rust-lang/setup-rust-toolchain@v1
               with:
-                  cache-on-failure: true
-                  save-if: ${{ github.ref == 'refs/heads/main' }}
+                  components: clippy, rustfmt
+                  target: wasm32-unknown-unknown
 
             - name: Check formatting
               run: cargo fmt --all --check
@@ -42,14 +42,13 @@ jobs:
               uses: actions/checkout@v5
 
             # TODO: Investigate why tests fail on stable toolchain.
-            - name: Set up Rust toolchain
-              run: rustup toolchain install nightly --no-self-update --profile default --target wasm32-unknown-unknown
 
-            - name: Set up Rust cache
-              uses: swatinem/rust-cache@v2
+            - name: Set up Rust toolchain
+              uses: actions-rust-lang/setup-rust-toolchain@v1
               with:
-                  cache-on-failure: true
-                  save-if: ${{ github.ref == 'refs/heads/main' }}
+                  components: clippy, rustfmt
+                  target: wasm32-unknown-unknown
+                  toolchain: nightly
 
             - name: Install Cargo Binary Install
               uses: cargo-bins/cargo-binstall@main

.github/workflows/release.yml

@@ -12,6 +12,9 @@ on:
                     - minor
                     - major
 
+permissions:
+    contents: write
+
 jobs:
     release:
         name: Release

.github/workflows/upstream.yml

@@ -5,6 +5,10 @@ on:
         - cron: '00 16 * * *'
     workflow_dispatch: {}
 
+permissions:
+    contents: read
+    pull-requests: write
+
 jobs:
     check:
         name: Check for upstream releases
@@ -15,13 +19,9 @@ jobs:
               uses: actions/checkout@v5
 
             - name: Set up Rust toolchain
-              run: rustup toolchain install nightly --no-self-update --profile default
-
-            - name: Set up Rust cache
-              uses: swatinem/rust-cache@v2
+              uses: actions-rust-lang/setup-rust-toolchain@v1
               with:
-                  cache-on-failure: true
-                  save-if: ${{ github.ref == 'refs/heads/main' }}
+                  components: clippy, rustfmt
 
             - name: Check for upstream releases
               run: cargo run -p scripts --bin upstream

.github/workflows/website.yml

@@ -5,6 +5,9 @@ on:
         branches:
             - main
 
+permissions:
+    contents: read
+
 concurrency:
     group: ${{ github.workflow }}-${{ github.ref }}
     cancel-in-progress: false
@@ -13,19 +16,15 @@ jobs:
     book-test:
         name: Test Book
         runs-on: ubuntu-latest
+
         steps:
             - uses: actions/checkout@v5
 
             - name: Set up Rust toolchain
-              run: |
-                  rustup toolchain install stable --no-self-update --profile minimal
-                  rustup target add wasm32-unknown-unknown
-
-            - name: Set up Rust cache
-              uses: swatinem/rust-cache@v2
+              uses: actions-rust-lang/setup-rust-toolchain@v1
               with:
-                  cache-on-failure: true
-                  save-if: ${{ github.ref == 'refs/heads/main' }}
+                  components: clippy, rustfmt
+                  target: wasm32-unknown-unknown
 
             - name: Install Cargo Binary Install
               uses: cargo-bins/cargo-binstall@main
@@ -41,21 +40,17 @@ jobs:
         name: Build Book
         needs: book-test
         runs-on: ubuntu-latest
+
         steps:
             - uses: actions/checkout@v5
               with:
                   fetch-depth: 0
 
             - name: Set up Rust toolchain
-              run: |
-                  rustup toolchain install stable --no-self-update --profile minimal
-                  rustup target add wasm32-unknown-unknown
-
-            - name: Set up Rust cache
-              uses: swatinem/rust-cache@v2
+              uses: actions-rust-lang/setup-rust-toolchain@v1
               with:
-                  cache-on-failure: true
-                  save-if: ${{ github.ref == 'refs/heads/main' }}
+                  components: clippy, rustfmt
+                  target: wasm32-unknown-unknown
 
             - name: Install Cargo Binary Install
               uses: cargo-bins/cargo-binstall@main
@@ -87,10 +82,12 @@ jobs:
         needs: book-build
         if: github.ref == 'refs/heads/main'
         runs-on: ubuntu-latest
+
         permissions:
             contents: read
             pages: write
             id-token: write
+
         steps:
             - uses: actions/checkout@v5
               with: