workflows: various CQA fixes

sigstore / sigstore-python

A Sigstore client written in Python

https://pypi.org/p/sigstore

Other

233 stars 49 forks source link

Closed woodruffw closed 2 months ago

woodruffw commented 2 months ago

A bunch of small quality fixes to our workflows.

Adds explicit persist-credential: settings everywhere, disabling the (default) credential persistence as much as possible.
Moves all permissions into steps and lowers the default outer permissions where explicit.
Replaces a shell interpolation of github.ref with GITHUB_REF.