🔒 fix zizmor findings (#55)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: igotinfected

.github/workflows/build-and-test.yml

@@ -18,6 +18,8 @@ jobs:
       changed: ${{ steps.filter.outputs.changed }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - name: 🔎 checking for changes
         uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4
         id: filter

.github/workflows/build-test-publish.yml

@@ -18,6 +18,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0 # required for MinVer
+          persist-credentials: false
 
       - name: setup .NET
         uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5

.github/workflows/publish.yml

@@ -4,6 +4,8 @@ on:
   release:
     types: [published]
 
+permissions: {}
+
 jobs:
   build-and-test:
     uses: ./.github/workflows/build-test-publish.yml
@@ -19,6 +21,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           sparse-checkout: global.json
+          persist-credentials: false
 
       - uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5
         with: