ci: update ci configuration

.github/workflows/check-dist.yml

@@ -20,6 +20,8 @@ jobs:
       - name: Checkout
         id: checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v3

.github/workflows/ci.yml

@@ -19,6 +19,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v3
@@ -38,7 +39,10 @@ jobs:
 
       - name: Validate PR commits with commitlint
         if: github.event_name == 'pull_request'
-        run: pnpm exec commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose
+        run: pnpm exec commitlint --from "${BASE_SHA}" --to "${HEAD_SHA}" --verbose
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
 
   test-typescript:
     name: TypeScript Tests
@@ -48,6 +52,8 @@ jobs:
       - name: Checkout
         id: checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v3

.github/workflows/codeql-analysis.yml

@@ -8,17 +8,19 @@ on:
     branches:
       - main
 
-permissions:
-  actions: read
-  checks: write
-  contents: read
-  security-events: write
+permissions: {}
 
 jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
 
+    permissions:
+      actions: read
+      checks: write
+      contents: read
+      security-events: write
+
     strategy:
       fail-fast: false
       matrix:
@@ -29,6 +31,8 @@ jobs:
       - name: Checkout
         id: checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
         id: initialize

.github/workflows/test-action.yml

@@ -8,19 +8,23 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
-  pull-requests: write
+permissions: {}
 
 jobs:
   test-action:
     name: GitHub Actions Test
     runs-on: ubuntu-24.04
 
+    permissions:
+      contents: read
+      pull-requests: write
+
     steps:
       - name: Checkout
         id: checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install required
         run: sudo apt-get install -y sqlcipher sqlite3-tools

README.md

@@ -17,15 +17,17 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
-  pull-requests: write
+permissions: {}
 
 jobs:
   test-action:
     name: GitHub Actions Test
     runs-on: ubuntu-24.04
 
+    permissions:
+      contents: read
+      pull-requests: write
+
     steps:
       - name: Install required
         run: sudo apt-get install -y sqlcipher sqlite3-tools