[eloi010]

Summary

• ci.yml and release-object.yml start from permissions: {} and grant each job only what it needs, following doc.linea:

  Job	Permissions
  build-and-test, zkevm-tests, blockchain-tests, guest-zisk, lint	contents: read
  blockchain-tests-result	none
  build-and-release	contents: write (creates the draft release)

  The repository's default token is already read-only, so CI behaves the same. Each job's access is now explicit, and stays limited if that default ever changes.

• release-object.yml sets cache: false on setup-zig, so a release downloads Zig instead of restoring it from the Actions cache.

Job names are unchanged, so the required checks still report. This merges cleanly with #203.

Testing

• actionlint is clean.
• CI on this PR runs every ci.yml job with the new permissions.
• release-object.yml only runs on dispatch. cache is a declared input of the pinned setup-zig (default 'true'), and 'false' skips both the cache restore and the cache save.

---

Note

Low Risk
Workflow-only changes that document least-privilege GITHUB_TOKEN use; release Zig setup may run slightly slower without cache but does not affect application code or runtime behavior.

Overview
Tightens GitHub Actions token scope in ci.yml and release-object.yml by setting workflow-level permissions: {} and granting per-job access only where needed (contents: read for test/build/lint jobs; contents: write only on the release job that creates draft releases).

For release builds, setup-zig now uses cache: false so Zig is fetched fresh on each manual release run instead of reusing the Actions cache.

^{Reviewed by Cursor Bugbot for commit 852130c. Bugbot is set up for automated code reviews on this repo. Configure here.}