fixed#485 - addressed zizmor findings in GitHub Actions (#486)

Author: firewave

.github/workflows/CI-unixish.yml

@@ -2,6 +2,9 @@ name: CI-unixish
 
 on: [push, pull_request]
 
+permissions:
+contents: read
+
 jobs:
 build:
 
@@ -23,6 +26,8 @@ jobs:
 
 steps:
  - uses: actions/checkout@v4
+with:
+persist-credentials: false
 
  - name: Install missing software on ubuntu
 if: matrix.os == 'ubuntu-24.04'

.github/workflows/CI-windows.yml

@@ -6,6 +6,9 @@ name: CI-windows
 
 on: [push,pull_request]
 
+permissions:
+contents: read
+
 defaults:
 run:
 shell: cmd
@@ -23,6 +26,8 @@ jobs:
 
 steps:
  - uses: actions/checkout@v4
+with:
+persist-credentials: false
 
  - name: Setup msbuild.exe
 uses: microsoft/setup-msbuild@v2

.github/workflows/clang-tidy.yml

@@ -4,13 +4,18 @@ name: clang-tidy
 
 on: [push, pull_request]
 
+permissions:
+contents: read
+
 jobs:
 build:
 
 runs-on: ubuntu-24.04
 
 steps:
  - uses: actions/checkout@v4
+with:
+persist-credentials: false
 
  - name: Install missing software
 run: |