From a6d1ce63eec16dec689b89c98a7fc9a487395c0e Mon Sep 17 00:00:00 2001 From: Samuel Attard Date: Thu, 2 Apr 2026 19:58:56 +0000 Subject: [PATCH] ci: fix zizmor audit findings --- .github/dependabot.yml | 2 ++ .github/workflows/release.yml | 2 ++ .github/workflows/test.yml | 2 ++ 3 files changed, 6 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 8ac6b8c..177b067 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,3 +4,5 @@ updates: directory: "/" schedule: interval: "monthly" + cooldown: + default-days: 7 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 42de441..1997069 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -5,6 +5,8 @@ on: branches: - main +permissions: {} + jobs: test: uses: ./.github/workflows/test.yml diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index e0c919c..039af1b 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -46,6 +46,8 @@ jobs: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Setup Node.js uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 with: