Tidy some files

Author: peternewman

.github/workflows/build.yaml

@@ -1,5 +1,9 @@
 name: build
 on: [push, pull_request]
+
+permissions:
+  contents: read
+
 jobs:
   build:
     name: "${{ matrix.id }}"
@@ -57,6 +61,8 @@ jobs:
       - name: Install Git
         run: apt-get -y install git
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Install build tools
         shell: bash
         run: |

.github/workflows/debian.yml

@@ -3,6 +3,10 @@
 
 name: debian
 on: [push, pull_request]
+
+permissions:
+  contents: read
+
 jobs:
   debian-build:
     name: 'Debian Build ${{ matrix.image_tag }} ${{ matrix.architecture }}'
@@ -28,6 +32,8 @@ jobs:
       - name: Install Git
         run: apt-get -y install git
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Install build tools
         run: apt-get -y install devscripts adduser fakeroot sudo
       - name: Install build dependencies
@@ -70,7 +76,9 @@ jobs:
         architecture: [amd64]
     container: debian:${{ matrix.image_tag }}
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Download build artifact
         uses: actions/download-artifact@v4
         with:

.github/workflows/isort.yml

@@ -1,12 +1,15 @@
 name: isort
 
-on:
-  - push
-  - pull_request
+on: [push, pull_request]
+
+permissions:
+  contents: read
 
 jobs:
   isort:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: isort/isort-action@v1

.github/workflows/lint.yaml

@@ -1,5 +1,9 @@
 name: lint
 on: [push, pull_request]
+
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build for Lint Tasks
@@ -17,6 +21,8 @@ jobs:
       - name: Install Git
         run: apt-get -y install git
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Install build tools
         shell: bash
         run: |
@@ -261,6 +267,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Setup Node.js v18
         uses: actions/setup-node@v3
         with: