update linting

Author: kernelsam

.github/linters

@@ -0,0 +1,5 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "*": ref-pin

.github/workflows/add-labels-standardized.yaml

@@ -6,11 +6,12 @@ on:
       - opened
       - reopened
 
-permissions:
-  issues: write
+permissions: {}
 
 jobs:
   add-issue-labels:
+    permissions:
+      issues: write
     secrets:
       ORG_MEMBERSHIP_TOKEN: ${{ secrets.ORG_MEMBERSHIP_TOKEN }}
       SENZING_MEMBERS: ${{ secrets.SENZING_MEMBERS }}

.github/workflows/add-to-project-senzing-dependabot.yaml

@@ -4,11 +4,12 @@ on:
   pull_request:
     branches: [main]
 
-permissions:
-  repository-projects: write
+permissions: {}
 
 jobs:
   add-to-project-dependabot:
+    permissions:
+      repository-projects: write
     secrets:
       SENZING_GITHUB_PROJECT_RW_TOKEN: ${{ secrets.SENZING_GITHUB_PROJECT_RW_TOKEN }}
     uses: senzing-factory/build-resources/.github/workflows/add-to-project-dependabot.yaml@v3

.github/workflows/add-to-project-senzing.yaml

@@ -6,16 +6,16 @@ on:
       - opened
       - reopened
 
-permissions:
-  repository-projects: write
+permissions: {}
 
 jobs:
   add-to-project:
+    permissions:
+      repository-projects: write
     secrets:
       SENZING_GITHUB_PROJECT_RW_TOKEN: ${{ secrets.SENZING_GITHUB_PROJECT_RW_TOKEN }}
     uses: senzing-factory/build-resources/.github/workflows/add-to-project.yaml@v3
     with:
-      classic: false
       project-number: ${{ vars.SENZING_GITHUB_ORGANIZATION_PROJECT }}
       org: ${{ vars.SENZING_GITHUB_ACCOUNT_NAME }}
 

.github/workflows/dependabot-approve-and-merge.yaml

@@ -4,12 +4,13 @@ on:
   pull_request:
     branches: [main]
 
-permissions:
-  contents: write
-  pull-requests: write
+permissions: {}
 
 jobs:
   dependabot-approve-and-merge:
+    permissions:
+      contents: write
+      pull-requests: write
     secrets:
       SENZING_GITHUB_CODEOWNER_PR_RW_TOKEN: ${{ secrets.SENZING_GITHUB_CODEOWNER_PR_RW_TOKEN }}
     uses: senzing-factory/build-resources/.github/workflows/dependabot-approve-and-merge.yaml@v3

.github/workflows/lint-workflows.yaml

@@ -6,12 +6,13 @@ on:
   pull_request:
     branches: [main]
 
-permissions:
-  contents: read
-  packages: read
-  pull-requests: read
-  statuses: write
+permissions: {}
 
 jobs:
   lint-workflows:
+    permissions:
+      contents: read
+      packages: read
+      pull-requests: read
+      statuses: write
     uses: senzing-factory/build-resources/.github/workflows/lint-workflows.yaml@v3

.github/workflows/move-pr-to-done-dependabot.yaml

@@ -5,11 +5,12 @@ on:
     branches: [main]
     types: [closed]
 
-permissions:
-  repository-projects: write
+permissions: {}
 
 jobs:
   move-pr-to-done-dependabot:
+    permissions:
+      repository-projects: write
     secrets:
       SENZING_GITHUB_PROJECT_RW_TOKEN: ${{ secrets.SENZING_GITHUB_PROJECT_RW_TOKEN }}
     uses: senzing-factory/build-resources/.github/workflows/move-pr-to-done-dependabot.yaml@v3

.github/workflows/spellcheck.yaml

@@ -4,15 +4,18 @@ on:
   pull_request:
     branches: [main]
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   spellcheck:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
 
     steps:
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - uses: streetsidesoftware/cspell-action@v7
         with: