Harden CI workflow per zizmor

[williammartin]

Fixes the two zizmor findings on .github/workflows/push.yml:

• excessive-permissions — added top-level permissions: contents: read so the workflow no longer runs with default-write GITHUB_TOKEN scopes. The job only checks out code and runs go test; read is sufficient.
• artipacked — added with: persist-credentials: false to the checkout step so the token isn't persisted into .git/config, eliminating a credential-leak vector if a later step ever uploads artifacts.

Verification

Run zizmor with the config below; expect zero findings:

rules:
  unpinned-uses:
    config:
      policies:
        # First-party GitHub-maintained orgs: tag pins are acceptable.
        # Releases from these orgs are signed, retag risk is low, and patch
        # bumps for free outweigh the SHA-pin defense-in-depth here.
        actions/*: ref-pin
        github/*: ref-pin
        dependabot/*: ref-pin
        # Our own shared workflows repo: branch/tag refs are acceptable.
        desktop/gh-cli-and-desktop-shared-workflows/*: ref-pin
        # Everything else must be SHA-pinned.
        "*": hash-pin
  dependabot-cooldown:
    config:
      days: 5

$ zizmor --config <above> .
No findings to report. Good job!

go test ./... still passes.

[Copilot]

Pull request overview

Hardens the CI workflow by reducing default GITHUB_TOKEN permissions and preventing credential persistence during checkout, addressing the two zizmor findings called out in the PR description.

Changes:

• Set workflow-wide permissions: contents: read to avoid default write-scoped GITHUB_TOKEN.
• Configure actions/checkout with persist-credentials: false to avoid writing credentials into .git/config.

Show a summary per file

File	Description
.github/workflows/push.yml	Limits GITHUB_TOKEN scope to read-only and disables credential persistence on checkout to reduce token exposure risk.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 0