ci: Run zizmor auto-fix, with some manual fixes to permissions

Author: kaylendog

.github/workflows/single_sdk_tests.yml

@@ -33,6 +33,8 @@ jobs:
       # if the workflow uses '.'
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Resolve branches
         shell: bash
         # these env vars will be modified and used in subsequent steps
@@ -128,9 +130,10 @@ jobs:
       # which we then pass to rebuild_rust_sdk.sh
       - name: Setup | Rust
         if: ${{ inputs.use_rust_sdk != '' }}
-        uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable v1.93.1
-        with:
-          toolchain: stable
+        run: |
+          rustup --version
+          rustup toolchain install 1.93.1
+          rustup default 1.93.1
       - name: "Download Rust SDK" # no need to download rust SDK if we are using the local checkout.
         if: ${{ inputs.use_rust_sdk != '' && inputs.use_rust_sdk != '.'}}
         run: |

.github/workflows/tests.yaml

@@ -1,5 +1,8 @@
 name: Tests
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: ["main"]
@@ -9,7 +12,7 @@ on:
 jobs:
   check-signoff:
     if: "github.event_name == 'pull_request'"
-    uses: "matrix-org/backend-meta/.github/workflows/sign-off.yml@v2"
+    uses: matrix-org/backend-meta@18beaf3c8e536108bd04d18e6c3dc40ba3931e28 # v2
 
   js-latest-main:
     name: Tests (JS only, latest)
@@ -30,6 +33,8 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       # Install Node, Go and Rust, along with gotestfmt
       - name: Setup | Node.js LTS
@@ -43,9 +48,10 @@ jobs:
         with:
           go-version: "1.21"
       - name: Setup | Rust
-        uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable v1.93.1
-        with:
-          toolchain: stable
+        run: |
+          rustup --version
+          rustup toolchain install stable
+          rustup default stable
       - name: Checkout matrix-rust-sdk
         run: |
           BRANCH=$(./.github/workflows/resolve_branch.sh matrix-org/matrix-rust-sdk)