Bump CI (#25)

Author: cristaloleg

.github/workflows/build.yml

@@ -1,12 +1,14 @@
 name: build
 
+permissions: read-all
+
 on:
   push:
     branches: [main]
   pull_request:
     branches: [main]
   schedule:
-    - cron: '0 0 * * 0'
+    - cron: '0 0 * * 0' # run "At 00:00 on Sunday"
   workflow_dispatch:
     inputs:
       tag:
@@ -17,13 +19,15 @@ on:
 # See https://github.com/cristalhq/.github/.github/workflows
 jobs:
   build:
-    uses: cristalhq/.github/.github/workflows/build.yml@main
-    
-  codeql:
-    uses: cristalhq/.github/.github/workflows/codeql.yml@main
+    uses: cristalhq/.github/.github/workflows/build.yml@v0.3.0
+
+  vuln:
+    uses: cristalhq/.github/.github/workflows/vuln.yml@v0.3.0
 
   release:
     if: github.event_name == 'workflow_dispatch'
-    uses: cristalhq/.github/.github/workflows/release.yml@main
+    permissions:
+      contents: write
+    uses: cristalhq/.github/.github/workflows/release.yml@v0.3.0
     with:
       tag: ${{ github.event.input.tag }}