Adhere to zizmor audit

.github/workflows/api-breakage.yml

@@ -6,6 +6,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-apibreakage
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   linux:
     runs-on: ubuntu-latest
@@ -14,9 +17,10 @@ jobs:
       image: swift:latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         fetch-depth: 0
+        persist-credentials: false
     # https://github.com/actions/checkout/issues/766
     - name: Mark the workspace as safe
       run: git config --global --add safe.directory ${GITHUB_WORKSPACE}

.github/workflows/swift.yml

@@ -11,13 +11,17 @@ on:
     types: [published]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   macOS:
     runs-on: macOS-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
       with:
         fetch-depth: 1
+        persist-credentials: false
     - name: Build
       run: swift build
     - name: Run tests
@@ -27,13 +31,14 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        image: ['swift:5.9', 'swift:5.10', 'swift:6.0']
+        image: ['swift:6.0', 'swift:6.1', 'swift:6.2']
     container:
       image: ${{ matrix.image }}
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         fetch-depth: 1
+        persist-credentials: false
     - name: Test
       run: swift test --parallel --enable-code-coverage