Thank you Dr. Zizmor!

Author: tmr232

.github/workflows/build.yaml

@@ -8,13 +8,26 @@ on:
   release:
     types:
       - created
+
+permissions: {}
+
 jobs:
   test:
     name: "Test"
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
+        with:
+          persist-credentials: false
+
+      - if: ${{ github.event_name == 'release' }}
+        uses: oven-sh/setup-bun@v2
+        with:
+          no-cache: true
+
+      - if: ${{ github.event_name != 'release' }}
+        uses: oven-sh/setup-bun@v2
+
 
       - run: bun install
 
@@ -31,7 +44,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
+        with:
+          persist-credentials: false
+
+      - if: ${{ github.event_name == 'release' }}
+        uses: oven-sh/setup-bun@v2
+        with:
+          no-cache: true
+
+      - if: ${{ github.event_name != 'release' }}
+        uses: oven-sh/setup-bun@v2
 
       - run: bun install
 
@@ -58,7 +80,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
+        with:
+          persist-credentials: false
+
+      - if: ${{ github.event_name == 'release' }}
+        uses: oven-sh/setup-bun@v2
+        with:
+          no-cache: true
+
+      - if: ${{ github.event_name != 'release' }}
+        uses: oven-sh/setup-bun@v2
 
       - run: bun install
       - run: bun build-webview

.github/workflows/pages.yaml

@@ -4,13 +4,19 @@ on:
   push:
     branches: "main"
 
+permissions: {}
+
 jobs:
   build:
     name: "Build Demo site"
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+            persist-credentials: false
       - uses: oven-sh/setup-bun@v2
+        with:
+          no-cache: true
 
       - run: bun install
 

zizmor.yml

@@ -0,0 +1,6 @@
+rules:
+  cache-poisoning:
+    ignore:
+      - build.yaml:29
+      - build.yaml:56
+      - build.yaml:92