chore(workflows): fix permissions / persist-credentials

Signed-off-by: Steve Beattie <steve.beattie@chainguard.dev>

Author: stevebeattie

.github/workflows/build.yaml

@@ -6,10 +6,15 @@ on:
   push:
     branches: ['main']
 
+permissions: {}
+
 jobs:
   build:
     name: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
 
     steps:
       - name: Harden Runner
@@ -18,6 +23,8 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version: '1.20'

.github/workflows/golangci-lint.yaml

@@ -20,6 +20,8 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version: '1.20'