ci: fixup workflows (#130)

Author: dsanders11

.github/workflows/lint.yml

@@ -16,6 +16,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      with:
+        persist-credentials: false
     - name: Setup Node.js
       uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
       with:

.github/workflows/needs-manual-audit.yml

@@ -5,12 +5,17 @@ on:
   schedule:
   - cron: '0 18 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   audit:
     name: Perform Manual Backport Audit
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      with:
+        persist-credentials: false
     - name: Setup Node.js
       uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
       with:

.github/workflows/test.yml

@@ -16,6 +16,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      with:
+        persist-credentials: false
     - name: Setup Node.js
       uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
       with:

.github/workflows/unreleased-audit.yml

@@ -5,12 +5,17 @@ on:
   schedule:
   - cron: '0 16 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   audit:
     name: Perform Unreleased Audit
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      with:
+        persist-credentials: false
     - name: Setup Node.js
       uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
       with:
@@ -22,4 +27,4 @@ jobs:
       env:
         SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
         UNRELEASED_GITHUB_APP_CREDS: ${{ secrets.UNRELEASED_GITHUB_APP_CREDS }}
-        ACTION_TYPE: 'unreleased'
+        ACTION_TYPE: 'unreleased'