chore(ci): Harden CI

.github/workflows/ci.yml

@@ -32,6 +32,8 @@ jobs:
           - 1.74.0 # MSRV
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Install Rust
         run: rustup install --profile minimal ${{ matrix.rust }} && rustup default ${{ matrix.rust }}
       - name: Install cross

.github/workflows/release.yml

@@ -1,7 +1,5 @@
 name: Release
 
-permissions:
-  contents: write
 
 on:
   push:
@@ -11,8 +9,12 @@ on:
 jobs:
   create-release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: taiki-e/[email protected]
         with:
           draft: true
@@ -23,6 +25,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - run: cargo publish --token ${CRATES_TOKEN}
         env:
           CRATES_TOKEN: ${{ secrets.CRATES_TOKEN }}
@@ -33,6 +37,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Get AUR repo
         run: git clone https://aur.archlinux.org/keyboard-backlightd.git aur
       - name: Update PKGBUILD

.github/workflows/rust-clippy.yml

@@ -20,6 +20,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Setup Rust
         run: rustup update stable && rustup default stable && rustup component add clippy