From 0df5ee3081e1e94943e109c557da3d209766c57b Mon Sep 17 00:00:00 2001
From: Samuel Attard <sattard@anthropic.com>
Date: Thu, 2 Apr 2026 19:58:48 +0000
Subject: [PATCH] ci: fix zizmor audit findings

---
 .github/workflows/semantic.yml | 4 ++++
 .github/workflows/test.yml     | 6 ++++++
 2 files changed, 10 insertions(+)

diff --git a/.github/workflows/semantic.yml b/.github/workflows/semantic.yml
index 92d7d7ab6d2..689907c2ff9 100644
--- a/.github/workflows/semantic.yml
+++ b/.github/workflows/semantic.yml
@@ -7,10 +7,14 @@ on:
       - edited
       - synchronize
 
+permissions: {}
+
 jobs:
   main:
     name: Validate PR Title
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
     steps:
       - name: semantic-pull-request
         uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 061c6d9002f..6ad0e3e47f9 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -6,11 +6,17 @@ on:
     branches:
       - main
 
+permissions: {}
+
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version: '24.x'