From 925fe037e54869cfb4129af16f86c080636f9539 Mon Sep 17 00:00:00 2001
From: xtqqczze <45661989+xtqqczze@users.noreply.github.com>
Date: Sat, 12 Sep 2026 16:54:13 +0100
Subject: [PATCH 1/2] fix: artipacked zizmor lint

https://docs.zizmor.sh/audits/#artipacked
---
 .github/workflows/ci.yml           | 8 ++++++++
 .github/workflows/code-quality.yml | 4 ++++
 2 files changed, 12 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 45ebaa2b..7289c1d0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,6 +15,8 @@ jobs:
         os: [ubuntu-latest, macOS-latest, windows-latest]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - if: ${{ contains(matrix.os, 'ubuntu') }}
         run: |
           sudo apt-get update -y
@@ -29,6 +31,8 @@ jobs:
         os: [ubuntu-latest, macOS-latest, windows-latest]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - if: ${{ contains(matrix.os, 'ubuntu') }}
         run: |
           sudo apt-get update -y
@@ -43,6 +47,8 @@ jobs:
         os: [ubuntu-latest, macOS-latest, windows-latest]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - if: ${{ contains(matrix.os, 'ubuntu') }}
         run: |
           sudo apt-get update -y
@@ -71,6 +77,8 @@ jobs:
           - { os: windows-latest , features: windows }
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Initialize workflow variables
       id: vars
       shell: bash
diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
index 731bf745..ed4ab635 100644
--- a/.github/workflows/code-quality.yml
+++ b/.github/workflows/code-quality.yml
@@ -26,6 +26,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: rustup component add rustfmt
@@ -46,6 +48,8 @@ jobs:
           - { os: windows-latest }
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: stable

From af8a68b7480fe8204297b9a26258c25919444347 Mon Sep 17 00:00:00 2001
From: xtqqczze <45661989+xtqqczze@users.noreply.github.com>
Date: Sat, 12 Sep 2026 16:55:47 +0100
Subject: [PATCH 2/2] fix: excessive-permissions zizmor lint

https://docs.zizmor.sh/audits/#excessive-permissions
---
 .github/workflows/audit.yml        | 5 +++++
 .github/workflows/ci.yml           | 5 ++++-
 .github/workflows/code-quality.yml | 6 +++---
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 92befe4e..2bc7749b 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -5,6 +5,11 @@ name: Security audit
 on:
   schedule:
     - cron: "0 0 * * *"
+
+permissions:
+  contents: read
+  issues: write
+
 jobs:
   audit:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7289c1d0..2a858f40 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,6 +1,9 @@
+name: Basic CI
+
 on: [push, pull_request]
 
-name: Basic CI
+permissions:
+  contents: read
 
 env:
   CARGO_TERM_COLOR: always
diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
index ed4ab635..99b99364 100644
--- a/.github/workflows/code-quality.yml
+++ b/.github/workflows/code-quality.yml
@@ -8,13 +8,13 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 env:
   # * style job configuration
   STYLE_FAIL_ON_FAULT: true ## (bool) fail the build if a style job contains a fault (error or warning); may be overridden on a per-job basis
 
-permissions:
-  contents: read # to fetch code (actions/checkout)
-
 # End the current execution if there is a new changeset in the PR.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}