Fix zizmor

Author: adamtheturtle

.github/workflows/docker-build.yml

@@ -1,5 +1,4 @@
 ---
-
 name: Build Docker images
 
 # This matches the Docker image building done in the release process.
@@ -17,6 +16,8 @@ on:
     - cron: 0 1 * * *
   workflow_dispatch: {}
 
+permissions: {}
+
 jobs:
   build:
     name: Build Docker images
@@ -31,6 +32,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3

.github/workflows/lint.yml

@@ -1,5 +1,4 @@
 ---
-
 name: Lint
 
 on:
@@ -13,9 +12,10 @@ on:
     - cron: 0 1 * * *
   workflow_dispatch: {}
 
+permissions: {}
+
 jobs:
   build:
-
     strategy:
       matrix:
         python-version: ['3.13']
@@ -25,6 +25,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Install uv
         uses: astral-sh/setup-uv@v7

.github/workflows/release.yml

@@ -1,5 +1,4 @@
 ---
-
 name: Release
 
 on: workflow_dispatch
@@ -29,6 +28,7 @@ jobs:
           # Also, avoids
           # https://github.com/stefanzweifel/git-auto-commit-action/issues/99.
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Install uv
         uses: astral-sh/setup-uv@v7

.github/workflows/test.yml

@@ -16,6 +16,8 @@ on:
 # workflows. We therefore want to run only one workflow at a time.
 concurrency: vuforia_credentials
 
+permissions: {}
+
 jobs:
   # CI tests with matrix
   ci-tests:
@@ -117,6 +119,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Install uv
         uses: astral-sh/setup-uv@v7
@@ -186,6 +190,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Install uv
         uses: astral-sh/setup-uv@v7
@@ -229,6 +235,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Install uv
         uses: astral-sh/setup-uv@v7
@@ -269,6 +277,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Install uv
         uses: astral-sh/setup-uv@v7