update workflows (#2018)

.github/workflows/add-to-project.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - id: get-secrets
-        uses: grafana/shared-workflows/actions/get-vault-secrets@main
+        uses: grafana/shared-workflows/actions/get-vault-secrets@main # zizmor: ignore[unpinned-uses]
         with:
           repo_secrets: |
             GITHUB_APP_ID=grafana-oss-big-tent:app-id

.github/workflows/compatibility-50.yml

@@ -1,5 +1,6 @@
 name: zabbix_50
 run-name: Compatibility with Zabbix 5.0 test
+permissions: {}
 
 on:
   push:
@@ -13,6 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       
       - uses: actions/setup-go@v5.3.0
 

.github/workflows/compatibility-60.yml

@@ -1,5 +1,6 @@
 name: zabbix_60
 run-name: Compatibility with Zabbix 6.0 test
+permissions: {}
 
 on:
   push:
@@ -13,6 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-go@v5.3.0
 

.github/workflows/compatibility-70.yml

@@ -1,5 +1,6 @@
 name: zabbix_70
 run-name: Compatibility with Zabbix 7.0 test
+permissions: {}
 
 on:
   push:
@@ -13,6 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-go@v5.3.0
 

.github/workflows/compatibility-72.yml

@@ -1,5 +1,6 @@
 name: zabbix_72
 run-name: Compatibility with Zabbix 7.2 test
+permissions: {}
 
 on:
   push:
@@ -13,6 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-go@v5.3.0
 

.github/workflows/is-compatible.yml

@@ -1,11 +1,14 @@
 name: Latest Grafana API compatibility check
 on: [pull_request]
+permissions: {}
 
 jobs:
   compatibilitycheck:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@v3
         with:
           node-version-file: '.nvmrc'

.github/workflows/publish.yaml

@@ -1,5 +1,6 @@
 name: Plugins - CD
 run-name: Deploy ${{ inputs.branch }} to ${{ inputs.environment }} by @${{ github.actor }}
+permissions: {}
 
 on:
   workflow_dispatch:

.github/workflows/push.yaml

@@ -1,4 +1,5 @@
 name: Plugins - CI
+permissions: {}
 
 on:
   push: