ci: scope permissions to jobs and disable credential persistence

Author: flavorjones

.github/workflows/ci.yml

@@ -15,11 +15,17 @@ on:
     branches:
       - '*'
 
+permissions: {}
+
 jobs:
   rubocop:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
       - run: rm Gemfile.lock
       - uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # zizmor: ignore[cache-poisoning] -- cached gems are used for testing, not release artifact generation # v1.316.0
         with:
@@ -30,6 +36,8 @@ jobs:
   lint-actions:
     name: GitHub Actions audit
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -50,8 +58,12 @@ jobs:
       matrix:
         ruby: ["2.7", "3.0", "3.1", "3.2", "3.3", "3.4", "4.0", "ruby-head", "truffleruby-head", "jruby-9.4", "jruby-10.0", "jruby-head"]
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
       - run: rm Gemfile.lock
       - uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # zizmor: ignore[cache-poisoning] -- cached gems are used for testing, not release artifact generation # v1.316.0
         with:
@@ -61,8 +73,12 @@ jobs:
 
   cruby-nokogiri-system-libraries:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
       - run: rm Gemfile.lock
       - uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0
         with: