sec(ci): improve CI security posture

Author: vados-cosmonic

.github/actions/mdbook/action.yml

@@ -43,6 +43,8 @@ runs:
   using: composite
   steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
 
     - uses: extractions/setup-just@v2
 

.github/workflows/deploy.yml

@@ -21,10 +21,7 @@ on:
         description: |
           The domain to which to publish (ex. 'component-model.bytecodealliance.org')
 
-permissions:
-  contents: read
-  pages: write
-  id-token: write
+permissions: {}
 
 concurrency:
   group: "pages"
@@ -33,6 +30,9 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pages: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
@@ -47,6 +47,9 @@ jobs:
   deploy:
     if: ${{ github.repository_owner == 'bytecodealliance' }}
     runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
     needs:
       - build
     environment: