Fix zizmor warnings

Author: elopez

.github/workflows/deploy.yml

@@ -23,6 +23,7 @@ jobs:
         with:
           fetch-depth: 0
           submodules: true
+          persist-credentials: false
       - name: Install mdbook
         run: |
           cargo install --git https://github.com/trail-of-forks/mdBook.git --branch building-secure-contracts mdbook || true

.github/workflows/echidna.yml

@@ -17,6 +17,9 @@ on:
     # run CI every day even if no PRs/merges occur
     - cron: "0 12 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     name: ${{ matrix.name }}
@@ -129,6 +132,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Checkout Damn Vulnerable DeFi solutions
         uses: actions/checkout@v5
@@ -137,6 +142,7 @@ jobs:
           repository: crytic/damn-vulnerable-defi-echidna
           ref: solutions
           path: ${{ matrix.workdir }}
+          persist-credentials: false
 
       - name: Set up Nodejs
         uses: actions/setup-node@v5

.github/workflows/lint_format.yml

@@ -6,6 +6,9 @@ on:
       - master
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -15,6 +18,7 @@ jobs:
         uses: actions/checkout@v5
         with:
           submodules: true
+          persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@v5

.github/workflows/lint_links.yml

@@ -15,13 +15,17 @@ on:
     # run CI at 09:00 every Tuesday even if no PRs/merges occur
     - cron: "0 9 * * 2"
 
+permissions:
+  contents: read
+
 jobs:
   markdown-link-check:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
         with:
           submodules: recursive
+          persist-credentials: false
       - uses: tcort/github-action-markdown-link-check@v1
         with:
           use-quiet-mode: "yes"

.github/workflows/manticore.yml

@@ -15,13 +15,16 @@ on:
     # run CI every day even if no PRs/merges occur
     - cron: "0 12 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     runs-on: ubuntu-22.04
-    strategy:
-      fail-fast: false
     steps:
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - name: Set up Python 3.8
         uses: actions/setup-python@v6
         with:

.github/workflows/medusa.yml

@@ -17,6 +17,9 @@ on:
     # run CI every day even if no PRs/merges occur
     - cron: "0 12 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     name: ${{ matrix.name }}
@@ -125,6 +128,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Checkout Damn Vulnerable DeFi solutions
         uses: actions/checkout@v5
@@ -133,6 +138,7 @@ jobs:
           repository: crytic/damn-vulnerable-defi-echidna
           ref: solutions
           path: ${{ matrix.workdir }}
+          persist-credentials: false
 
       - name: Set up Nodejs
         uses: actions/setup-node@v5