From 70517c75e45231834820170bfa60bc967f515aa9 Mon Sep 17 00:00:00 2001
From: Ed Page <eopage@gmail.com>
Date: Sat, 19 Sep 2026 06:41:19 -0500
Subject: [PATCH] chore(ci): Clean up test action

---
 .github/workflows/test-action.yml | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/test-action.yml b/.github/workflows/test-action.yml
index 6ea1b415..a454f211 100644
--- a/.github/workflows/test-action.yml
+++ b/.github/workflows/test-action.yml
@@ -1,5 +1,10 @@
 name: Test GitHub Action
-on: [pull_request]
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
 
 jobs:
   shallow:
@@ -9,8 +14,10 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-    - name: Checkout Actions Repository
-      uses: actions/checkout@v6
+    - name: Checkout repository
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: Install wget for Windows
       if: matrix.os == 'windows-latest'
@@ -38,9 +45,10 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-    - name: Checkout Actions Repository
-      uses: actions/checkout@v6
+    - name: Checkout repository
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
+        persist-credentials: false
         fetch-depth: 0
 
     - name: Install wget for Windows