Try fixes

.github/workflows/build.yaml

@@ -36,6 +36,8 @@ jobs:
         # Error Prone checks available only from other artifact repositories.
       - name: Check out code
         uses: actions/[email protected]
+        with:
+          persist-credentials: false
       - name: Set up JDK
         uses: actions/[email protected]
         with:

.github/workflows/deploy-website.yaml

@@ -3,16 +3,18 @@ on:
   pull_request:
   push:
     branches: [ master, website ]
+permissions:
+  contents: read
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   build:
-    permissions:
-      contents: read
     runs-on: ubuntu-22.04
     steps:
       - name: Check out code
         uses: actions/[email protected]
+        with:
+          persist-credentials: false
       - uses: ruby/[email protected]
         with:
           working-directory: ./website

.github/workflows/openssf-scorecard.yml

@@ -18,7 +18,6 @@ jobs:
     steps:
       - name: Check out code
         uses: actions/[email protected]
-        # XXX: Also apply elsewhere?
         with:
           persist-credentials: false
       - name: Run OpenSSF Scorecard analysis

.github/workflows/pitest-analyze-pr.yml

@@ -15,6 +15,7 @@ jobs:
         uses: actions/[email protected]
         with:
           fetch-depth: 2
+          persist-credentials: false
       - name: Set up JDK
         uses: actions/[email protected]
         with:

.github/workflows/pitest-update-pr.yml

@@ -9,16 +9,20 @@ on:
       - completed
 permissions:
   actions: read
-  checks: write
-  contents: read
-  pull-requests: write
 jobs:
   update-pr:
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    permissions:
+      actions: read
+      checks: write
+      contents: read
+      pull-requests: write
     runs-on: ubuntu-22.04
     steps:
       - name: Check out code
         uses: actions/[email protected]
+        with:
+          persist-credentials: false
       - name: Set up JDK
         uses: actions/[email protected]
         with: