From 200b421a50b4f347fdcaab372a7072b725b49b78 Mon Sep 17 00:00:00 2001 From: Samuel Attard Date: Thu, 2 Apr 2026 19:57:15 +0000 Subject: [PATCH] ci: fix zizmor audit findings --- .github/dependabot.yml | 2 ++ .github/workflows/build.yml | 2 ++ .github/workflows/release.yml | 6 ++++++ .github/workflows/test.yml | 2 ++ 4 files changed, 12 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 8ac6b8c..177b067 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,3 +4,5 @@ updates: directory: "/" schedule: interval: "monthly" + cooldown: + default-days: 7 diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index da7d06d..aca553e 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -19,6 +19,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Setup Node.js uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 with: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6230647..046ef3e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -5,11 +5,17 @@ on: branches: - main +permissions: {} + jobs: test: + permissions: + contents: read uses: ./.github/workflows/test.yml build: + permissions: + contents: read uses: ./.github/workflows/build.yml release: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 3750e09..5670f0f 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -27,6 +27,8 @@ jobs: - run: git config --global core.autocrlf input - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Setup Node.js uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 with: