zizmor should be happy now

.github/workflows/build-and-test-min-cmake.yml

diff --git a/.github/workflows/build-and-test-min-cmake.yml b/.github/workflows/build-and-test-min-cmake.yml
index bd829eb..5c69822 100644
--- a/.github/workflows/build-and-test-min-cmake.yml
+++ b/.github/workflows/build-and-test-min-cmake.yml
@@ -6,6 +6,9 @@
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 env:
   CMAKE_GENERATOR: Ninja
 
@@ -28,7 +31,7 @@
           cmakeVersion: 3.13.0
 
       - name: create build environment
-        run: cmake -E make_directory ${{ runner.workspace }}/_build
+        run: cmake -E make_directory $RUNNER_WORKSPACE/_build
 
       - name: setup cmake initial cache
         run: touch compiler-cache.cmake

.github/workflows/build-and-test-perfcounters.yml

diff --git a/.github/workflows/build-and-test-perfcounters.yml b/.github/workflows/build-and-test-perfcounters.yml
index 3a9a5cd..2c12e60 100644
--- a/.github/workflows/build-and-test-perfcounters.yml
+++ b/.github/workflows/build-and-test-perfcounters.yml
@@ -33,7 +33,7 @@
         sudo apt -y install libpfm4-dev
 
     - name: create build environment
-      run: cmake -E make_directory ${{ runner.workspace }}/_build
+      run: cmake -E make_directory $RUNNER_WORKSPACE/_build
 
     - name: configure cmake
       shell: bash

.github/workflows/build-and-test.yml

diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index 32b0060..ef10549 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -6,6 +6,9 @@
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 env:
   CMAKE_GENERATOR: Ninja
 

.github/workflows/pre-commit.yml

diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 5a8beb8..0dd49e6 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -6,6 +6,9 @@
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   pre-commit:
     runs-on: ubuntu-latest

.github/workflows/sanitizer.yml

diff --git a/.github/workflows/sanitizer.yml b/.github/workflows/sanitizer.yml
index ab93581..6451ba7 100644
--- a/.github/workflows/sanitizer.yml
+++ b/.github/workflows/sanitizer.yml
@@ -4,6 +4,9 @@
   push: {}
   pull_request: {}
 
+permissions:
+  contents: read
+
 env:
   CMAKE_GENERATOR: Ninja
   UBSAN_OPTIONS: "print_stacktrace=1"

.github/workflows/wheels.yml

diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml
index 9f00e3f..3dbbb19 100644
--- a/.github/workflows/wheels.yml
+++ b/.github/workflows/wheels.yml
@@ -9,6 +9,9 @@
 env:
   CMAKE_GENERATOR: Ninja
 
+permissions:
+  contents: read
+
 jobs:
   build_sdist:
     name: Build source distribution