[CI] Fix issues in GHA workflows (#16282)

Fixes some issues found by https://docs.zizmor.sh

Author: straight-shoota

.github/workflows/aarch64-github.yml

@@ -16,7 +16,9 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Download Crystal source
-        uses: actions/checkout@v5
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Install LLVM 20
         run: |
@@ -44,7 +46,9 @@ jobs:
     needs: [aarch64-github-cross-compile]
     steps:
       - name: Checkout Crystal source
-        uses: actions/checkout@v5
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Install LLVM 20
         run: |

.github/workflows/aarch64.yml

@@ -15,6 +15,8 @@ jobs:
     steps:
       - name: Download Crystal source
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - name: Build Crystal
         uses: docker://crystallang/crystal:1.13.2-alpine-84codes-build
         with:
@@ -33,6 +35,8 @@ jobs:
     steps:
       - name: Download Crystal source
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - name: Download Crystal executable
         uses: actions/download-artifact@v5
         with:
@@ -50,6 +54,8 @@ jobs:
     steps:
       - name: Download Crystal source
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - name: Download Crystal executable
         uses: actions/download-artifact@v5
         with:
@@ -66,6 +72,8 @@ jobs:
     steps:
       - name: Download Crystal source
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - name: Build Crystal
         uses: docker://crystallang/crystal:1.13.2-ubuntu-84codes-build
         with:
@@ -84,6 +92,8 @@ jobs:
     steps:
       - name: Download Crystal source
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - name: Download Crystal executable
         uses: actions/download-artifact@v5
         with:
@@ -101,6 +111,8 @@ jobs:
     steps:
       - name: Download Crystal source
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - name: Download Crystal executable
         uses: actions/download-artifact@v5
         with:

.github/workflows/backport.yml

@@ -8,6 +8,7 @@ name: Backport
 on:
   pull_request_target:
     types: [closed, labeled]
+    branches: [master, release/*]
 
 permissions:
   contents: write # so it can comment
@@ -23,6 +24,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           token: ${{ secrets.BACKPORT_ACTION_GITHUB_PAT }}
+          persist-credentials: false
 
       - name: Create backport PR
         uses: korthout/backport-action@d07416681cab29bf2661702f925f020aaa962997 # v3.4.1

.github/workflows/docs.yml

@@ -20,6 +20,8 @@ jobs:
     steps:
       - name: Download Crystal source
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Prepare System
         run: bin/ci prepare_system

.github/workflows/forward-compatibility.yml

@@ -53,6 +53,8 @@ jobs:
     steps:
       - name: Download Crystal source
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Prepare System
         run: bin/ci prepare_system

.github/workflows/interpreter.yml

@@ -19,6 +19,8 @@ jobs:
     name: "Test Interpreter"
     steps:
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Test interpreter_spec
         run: make interpreter_spec junit_output=.junit/interpreter_spec.xml
@@ -30,6 +32,8 @@ jobs:
     name: Build interpreter
     steps:
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Build compiler
         run: make interpreter=1 release=1
@@ -53,6 +57,8 @@ jobs:
     name: "Test std_spec with interpreter (${{ matrix.part }})"
     steps:
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Download compiler artifact
         uses: actions/download-artifact@v5
@@ -74,6 +80,8 @@ jobs:
     name: "Test primitives_spec with interpreter"
     steps:
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Download compiler artifact
         uses: actions/download-artifact@v5

.github/workflows/lint-actionlint.yml

@@ -7,10 +7,14 @@ on:
     paths:
       - '.github/workflows/*.yml'
 
+permissions: {}
+
 jobs:
   actionlint:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - name: Check workflow files
         uses: docker://rhysd/actionlint:latest

.github/workflows/lint-shellcheck.yml

@@ -22,4 +22,6 @@ jobs:
     steps:
       - run: shellcheck --version
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - run: make lint-shellcheck

.github/workflows/linux.yml

@@ -35,6 +35,8 @@ jobs:
     steps:
       - name: Download Crystal source
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Prepare System
         run: bin/ci prepare_system
@@ -53,6 +55,8 @@ jobs:
     steps:
       - name: Download Crystal source
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Prepare System
         run: bin/ci prepare_system
@@ -71,6 +75,8 @@ jobs:
     steps:
       - name: Download Crystal source
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Prepare System
         run: bin/ci prepare_system
@@ -92,6 +98,8 @@ jobs:
     steps:
       - name: Download Crystal source
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Prepare System
         run: bin/ci prepare_system
@@ -108,6 +116,8 @@ jobs:
     steps:
     - name: Checkout Actions Repository
       uses: actions/checkout@v5
+      with:
+        persist-credentials: false
 
     - name: Spell Check Repo
       uses: crate-ci/typos@80c8a4945eec0f6d464eaf9e65ed98ef085283d1 # v1.38.1
@@ -120,5 +130,7 @@ jobs:
     steps:
       - name: Download Crystal source
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - run: ameba

.github/workflows/llvm.yml

@@ -51,6 +51,8 @@ jobs:
     steps:
       - name: Checkout Crystal source
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Install LLVM ${{ matrix.llvm_version || 'Nightly' }}
         run: |