File sync from hanakai-rb/repo-sync

Updated files:

- .github/workflows/ci.yml
- .github/workflows/ci-lint.yml

Author: github-actions[bot]

.github/workflows/ci-lint.yml

@@ -19,8 +19,6 @@ jobs:
   zizmor:
     name: Run zizmor
     runs-on: ubuntu-latest
-    permissions:
-      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
@@ -29,3 +27,5 @@ jobs:
 
       - name: Run zizmor
         uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d
+        with:
+          advanced-security: false

.github/workflows/ci.yml

@@ -12,6 +12,9 @@ on:
   schedule:
     - cron: "30 4 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     name: Tests (Ruby ${{ matrix.ruby }})
@@ -34,6 +37,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98
+        with:
+          persist-credentials: false
       - name: Install package dependencies
         run: "[ -e $APT_DEPS ] || sudo apt-get install -y --no-install-recommends $APT_DEPS"
       - name: Set up Ruby
@@ -69,7 +74,7 @@ jobs:
     permissions:
       actions: write
     steps:
-      - uses: liskin/gh-workflow-keepalive@v1
+      - uses: liskin/gh-workflow-keepalive@7a9194bad497f0b993708eeaf10fc0a2d726eb71
 
   release:
     runs-on: ubuntu-latest