chore: address Zizmor security findings in GHA workflows

Fixes #285

- persist-credentials: false on all actions/checkout steps (artipacked).
- Top-level permissions: {} in publish_fgpyo.yml and wheels.yml, with
  per-job least-privilege scoping (contents: read for reading jobs,
  permissions: {} for reusable-workflow callers).
- Disabled setup-uv cache in tests.yml (cache-poisoning).

The dangerous-triggers finding in readthedocs.yml is deferred to #283,
which removes that workflow entirely.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: msto

.github/workflows/publish_fgpyo.yml

@@ -4,9 +4,13 @@ on:
   push:
     tags: '[0-9]+.[0-9]+.[0-9]+'
 
+permissions: {}
+
 jobs:
   on-main-branch-check:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       on_main: ${{ steps.contains_tag.outputs.retval }}
     steps:
@@ -21,6 +25,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: rickstaa/action-contains-tag@a9ff27d505ba2bf074a2ebb48b208e76d35ff308  # v1.2.10
         id: contains_tag
@@ -32,22 +37,27 @@ jobs:
     name: tests
     needs: on-main-branch-check
     if: ${{ needs.on-main-branch-check.outputs.on_main == 'true' }}
+    permissions: {}
     uses: "./.github/workflows/tests.yml"
 
   build-wheels:
     name: build wheels
     needs: tests
+    permissions: {}
     uses: "./.github/workflows/wheels.yml"
 
   build-sdist:
     name: build source distribution
     needs: tests
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
         with:
@@ -86,6 +96,8 @@ jobs:
   make-changelog:
     runs-on: ubuntu-latest
     needs: publish-to-pypi
+    permissions:
+      contents: read
     outputs:
       release_body: ${{ steps.git-cliff.outputs.content }}
     steps:
@@ -94,6 +106,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ github.ref_name }}
+          persist-credentials: false
 
       - name: Generate a Changelog
         uses: orhun/git-cliff-action@c93ef52f3d0ddcdcc9bd5447d98d458a11cd4f72  # v4.7.1

.github/workflows/tests.yml

@@ -24,13 +24,15 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Install uv
         uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
         with:
           version: "${{ env.UV_VERSION }}"
           python-version: "${{ matrix.PYTHON_VERSION }}"
-          enable-cache: 'true'
+          enable-cache: false
           cache-suffix: "${{ matrix.PYTHON_VERSION }}"
 
       - name: Install dependencies

.github/workflows/wheels.yml

@@ -8,17 +8,23 @@ on:
 env:
   UV_VERSION: 0.8.22
 
+permissions: {}
+
 jobs:
   build-wheels:
     name: Build wheels for ${{ matrix.PYTHON_VERSION }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
         PYTHON_VERSION: ["3.10", "3.11", "3.12", "3.13"]
 
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Install uv
         uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0