From 3856ba1a4cf9d3615e1e083ff80e51e35dcad0af Mon Sep 17 00:00:00 2001
From: Joshua Napoli <jnapoli@cvector.energy>
Date: Mon, 8 Jun 2026 21:50:39 -0400
Subject: [PATCH] [PD1-905] Roll out zizmor

Resolve all zizmor GitHub Actions static-analysis findings.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c9087c7..ac07f84 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,8 +10,13 @@ jobs:
   test:
     runs-on: ubuntu-24.04
 
+    permissions:
+      contents: read
+
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
       - name: Enable Corepack for yarn
         run: corepack enable