workflows/codeql: fix zizmor findings

Signed-off-by: Patrick Linnane <[email protected]>
Homebrew · Dec 27, 2024 · 03f28d5 · 03f28d5
1 parent 3a0cf73
commit 03f28d5
Showing 1 changed file with 6 additions and 5 deletions.
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -8,18 +8,19 @@ on:
    branches:
      - main
 
-permissions:
-  actions: read
-  contents: read
-  security-events: write
-
 jobs:
   analyze:
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
 
     steps:
     - name: Checkout repository
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
 
     - name: Initialize CodeQL
       uses: github/codeql-action/init@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0