From 856067c60e1413dd22f6e38802e198d63adf041e Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Mon, 29 Jun 2026 13:26:26 +0200
Subject: [PATCH 1/3] ci: Drop default token permissions

This remediates https://docs.zizmor.sh/audits/#excessive-permissions
---
 .github/workflows/build.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 98f0128..f10ed31 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -9,9 +9,13 @@ on:
   pull_request:
   merge_group:
 
+permissions: {}
+
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
         rust: [stable, beta, nightly]

From 87bd63e328e5b44fa3d26a227d5c3780fb40c386 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Mon, 29 Jun 2026 13:27:57 +0200
Subject: [PATCH 2/3] ci: Bump actions/checkout

---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f10ed31..7df6670 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -22,7 +22,7 @@ jobs:
         zookeeper: [3.9.4, 3.9.3, 3.9.2, 3.8.4, 3.7.2, 3.6.4, 3.5.10]
     steps:
       - name: Check out repository code
-        uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - run: rustup default ${{ matrix.rust }}
       - run: wget -O zookeeper.tar.gz https://archive.apache.org/dist/zookeeper/zookeeper-${{ matrix.zookeeper }}/apache-zookeeper-${{ matrix.zookeeper }}-bin.tar.gz
       - run: mkdir zookeeper

From e90b8e6c296d64852d9618dc85d6d0ff6da04ae0 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Mon, 29 Jun 2026 13:29:09 +0200
Subject: [PATCH 3/3] ci: Do not persist credentials

This remediates https://docs.zizmor.sh/audits/#artipacked
---
 .github/workflows/build.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7df6670..5c4ec8b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -23,6 +23,8 @@ jobs:
     steps:
       - name: Check out repository code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - run: rustup default ${{ matrix.rust }}
       - run: wget -O zookeeper.tar.gz https://archive.apache.org/dist/zookeeper/zookeeper-${{ matrix.zookeeper }}/apache-zookeeper-${{ matrix.zookeeper }}-bin.tar.gz
       - run: mkdir zookeeper