apply zizmor recs (#133)

Author: matt-hensley

.github/workflows/dotnet-format.yml

@@ -15,10 +15,13 @@ on:
 jobs:
   check-format:
     runs-on: windows-latest
+    permissions: {}
 
     steps:
     - name: check out code
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - name: Install format tool
       run: dotnet tool install -g dotnet-format

.github/workflows/markdown-link-check.yml

@@ -13,10 +13,13 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions: {}
 
     steps:
     - name: check out code
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - name: install markdown-link-check
       run: sudo npm install -g markdown-link-check

.github/workflows/markdownlint.yml

@@ -13,10 +13,13 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions: {}
 
     steps:
     - name: check out code
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - name: install markdownlint-cli
       run: sudo npm install -g markdownlint-cli

.github/workflows/misspell.yml

@@ -9,10 +9,13 @@ on:
 jobs:
   misspell:
     runs-on: ubuntu-latest
+    permissions: {}
 
     steps:
     - name: check out code
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - name: install misspell
       run: |

.github/workflows/oats.yml

@@ -9,14 +9,19 @@ on:
 jobs:
   acceptance-tests:
     runs-on: ubuntu-latest
+    permissions: {}
+
     steps:
       - name: Check out
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Check out oats
         uses: actions/checkout@v4
         with:
           repository: grafana/oats
           path: oats
+          persist-credentials: false
       - name: Set up Go
         uses: actions/setup-go@v5
         with:

.github/workflows/unit-tests.yml

@@ -20,12 +20,14 @@ jobs:
         exclude:
         - os: ubuntu-latest
           version: net462
+    permissions: {}
 
     runs-on: ${{ matrix.os }}
     steps:
     - uses: actions/checkout@v4
       with:
         fetch-depth: 0 # fetching all
+        persist-credentials: false
 
     - name: Setup dotnet
       uses: actions/setup-dotnet@v3