From 3941603f4422d16581e5d782458fa6fbfd432932 Mon Sep 17 00:00:00 2001
From: Jonas Bernoulli <jonas@bernoul.li>
Date: Mon, 20 Apr 2026 10:35:30 +0200
Subject: ci: Reduce permissions and add zizmor setting

---
 .github/workflows/compile.yml | 4 +++-
 .github/workflows/manual.yml  | 4 +++-
 .github/workflows/stats.yml   | 4 +++-
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/compile.yml b/.github/workflows/compile.yml
index 2c1a987..2102237 100644
--- a/.github/workflows/compile.yml
+++ b/.github/workflows/compile.yml
@@ -3,4 +3,6 @@ on: [push, pull_request]
 jobs:
   compile:
     name: Compile
-    uses: emacscollective/workflows/.github/workflows/compile.yml@main
+    uses: | # zizmor: ignore[unpinned-uses] same maintainer as this repo
+      emacscollective/workflows/.github/workflows/compile.yml@main
+    permissions: {}
diff --git a/.github/workflows/manual.yml b/.github/workflows/manual.yml
index 2a655ae..e69a6ce 100644
--- a/.github/workflows/manual.yml
+++ b/.github/workflows/manual.yml
@@ -6,6 +6,8 @@ on:
 jobs:
   manual:
     name: Manual
-    uses: emacscollective/workflows/.github/workflows/manual.yml@main
+    uses: | # zizmor: ignore[unpinned-uses] same maintainer as this repo
+      emacscollective/workflows/.github/workflows/manual.yml@main
+    permissions: {}
     secrets:
       rclone_config: ${{ secrets.RCLONE_CONFIG }}
diff --git a/.github/workflows/stats.yml b/.github/workflows/stats.yml
index 5597fb9..bff434a 100644
--- a/.github/workflows/stats.yml
+++ b/.github/workflows/stats.yml
@@ -7,6 +7,8 @@ on:
 jobs:
   stats:
     name: Statistics
-    uses: emacscollective/workflows/.github/workflows/stats.yml@main
+    uses: | # zizmor: ignore[unpinned-uses] same maintainer as this repo
+      emacscollective/workflows/.github/workflows/stats.yml@main
+    permissions: {}
     secrets:
       rclone_config: ${{ secrets.RCLONE_CONFIG }}
-- 
cgit v1.0