Address zizmor findings

.github/workflows/audit.yaml

@@ -9,6 +9,7 @@ name: Audit
       - trunk
   schedule:
     - cron: "0 0 * * TUE"
+permissions: {}
 jobs:
   ruby:
     name: Audit Ruby Dependencies
@@ -17,6 +18,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/[email protected]
+        with:
+          persist-credentials: false
 
       - name: Install Ruby toolchain
         uses: ruby/setup-ruby@2654679fe7f7c29875c669398a8ec0791b8a64a1 # v1.215.0
@@ -42,6 +45,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/[email protected]
+        with:
+          persist-credentials: false
 
       - name: Install Rust toolchain
         uses: artichoke/setup-rust/[email protected]

.github/workflows/block-merge.yaml

@@ -3,10 +3,14 @@ name: Merge
 "on":
   pull_request:
     types: [opened, labeled, unlabeled, synchronize]
+permissions: {}
 jobs:
   labels:
     name: Labels
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
 
     steps:
       - uses: mheap/github-action-required-labels@388fd6af37b34cdfe5a23b37060e763217e58b03 # v5.5

.github/workflows/ci.yaml

@@ -9,6 +9,7 @@ name: CI
       - trunk
   schedule:
     - cron: "0 0 * * TUE"
+permissions: {}
 jobs:
   build:
     name: Build
@@ -23,6 +24,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/[email protected]
+        with:
+          persist-credentials: false
 
       - name: Install Rust toolchain
         uses: artichoke/setup-rust/[email protected]
@@ -53,6 +56,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/[email protected]
+        with:
+          persist-credentials: false
 
       - name: Install Rust toolchain
         uses: artichoke/setup-rust/[email protected]
@@ -83,6 +88,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/[email protected]
+        with:
+          persist-credentials: false
 
       - name: Install Rust toolchain
         uses: artichoke/setup-rust/[email protected]
@@ -104,6 +111,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/[email protected]
+        with:
+          persist-credentials: false
 
       - name: Install Rust toolchain
         uses: artichoke/setup-rust/[email protected]
@@ -122,6 +131,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/[email protected]
+        with:
+          persist-credentials: false
 
       - name: Install Ruby toolchain
         uses: ruby/setup-ruby@2654679fe7f7c29875c669398a8ec0791b8a64a1 # v1.215.0
@@ -138,6 +149,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/[email protected]
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js runtime
         uses: actions/[email protected]

.github/workflows/fuzz.yaml

@@ -3,6 +3,7 @@ name: Fuzz
 "on":
   schedule:
     - cron: "0 9 * * *"
+permissions: {}
 jobs:
   encode:
     name: Fuzz encode
@@ -13,6 +14,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/[email protected]
+        with:
+          persist-credentials: false
 
       - name: Install Rust toolchain
         uses: artichoke/setup-rust/[email protected]
@@ -34,6 +37,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/[email protected]
+        with:
+          persist-credentials: false
 
       - name: Install Rust toolchain
         uses: artichoke/setup-rust/[email protected]
@@ -55,6 +60,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/[email protected]
+        with:
+          persist-credentials: false
 
       - name: Install Rust toolchain
         uses: artichoke/setup-rust/[email protected]

.github/workflows/repo-labels.yaml

@@ -14,13 +14,19 @@
       - .github/workflows/repo-labels.yaml
   schedule:
     - cron: "0 0 * * TUE"
+permissions: {}
 name: Create Repository Labels
 jobs:
   labels:
     name: Synchronize repository labels
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
     steps:
       - uses: actions/[email protected]
+        with:
+          persist-credentials: false
 
       - name: Sync GitHub Issue Labels
         uses: crazy-max/ghaction-github-labeler@b54af0c25861143e7c8813d7cbbf46d2c341680c # v5.1.0

.github/workflows/rustdoc.yaml

@@ -9,6 +9,7 @@ name: Documentation
       - trunk
   schedule:
     - cron: "0 0 * * TUE"
+permissions: {}
 concurrency:
   group: docs-${{ github.head_ref }}
 env:
@@ -17,13 +18,17 @@ jobs:
   rustdoc:
     name: Build Rust API docs
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     env:
       RUSTDOCFLAGS: -D warnings -D rustdoc::broken_intra_doc_links --cfg docsrs
       RUST_BACKTRACE: 1
 
     steps:
       - name: Checkout repository
         uses: actions/[email protected]
+        with:
+          persist-credentials: false
 
       - name: Install Rust toolchain
         uses: artichoke/setup-rust/[email protected]