From 43c77eb19d903b1eb923148c7007df660fbae712 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Dani=C3=ABlle=20Huisman?= <danielle@huisman.me>
Date: Mon, 25 Aug 2025 16:04:52 +0200
Subject: [PATCH] ci: add workflow permissions

---
 .github/workflows/ci.yml      | 16 ++++++++--------
 .github/workflows/website.yml | 22 ++++++----------------
 2 files changed, 14 insertions(+), 24 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 692fd6f..8e1f2a0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,9 @@ on:
         branches:
             - main
 
+permissions:
+    contents: read
+
 env:
     RUSTFLAGS: '-Dwarnings'
 
@@ -19,13 +22,10 @@ jobs:
               uses: actions/checkout@v5
 
             - name: Set up Rust toolchain
-              run: rustup toolchain install stable --no-self-update --profile default --target wasm32-unknown-unknown
-
-            - name: Set up Rust cache
-              uses: swatinem/rust-cache@v2
+              uses: actions-rust-lang/setup-rust-toolchain@v1
               with:
-                  cache-on-failure: true
-                  save-if: ${{ github.ref == 'refs/heads/main' }}
+                  components: clippy, rustfmt
+                  target: wasm32-unknown-unknown
 
             - name: Install Cargo packages
               run: cargo install wasm-pack
@@ -34,10 +34,10 @@ jobs:
               run: cargo fmt --all --check
 
             - name: Lint
-              run: cargo clippy --all-features
+              run: cargo clippy --all-features --locked
 
             - name: Test
-              run: cargo test --all-features
+              run: cargo test --all-features --locked --release
 
             - name: Test in Browser
               run: wasm-pack test --headless --release --chrome --firefox
diff --git a/.github/workflows/website.yml b/.github/workflows/website.yml
index c89b9c6..2680a45 100644
--- a/.github/workflows/website.yml
+++ b/.github/workflows/website.yml
@@ -17,15 +17,10 @@ jobs:
             - uses: actions/checkout@v5
 
             - name: Set up Rust toolchain
-              run: |
-                  rustup toolchain install stable --no-self-update --profile minimal
-                  rustup target add wasm32-unknown-unknown
-
-            - name: Set up Rust cache
-              uses: swatinem/rust-cache@v2
+              uses: actions-rust-lang/setup-rust-toolchain@v1
               with:
-                  cache-on-failure: true
-                  save-if: ${{ github.ref == 'refs/heads/main' }}
+                  components: clippy, rustfmt
+                  target: wasm32-unknown-unknown
 
             - name: Install Cargo Binary Install
               uses: cargo-bins/cargo-binstall@main
@@ -47,15 +42,10 @@ jobs:
                   fetch-depth: 0
 
             - name: Set up Rust toolchain
-              run: |
-                  rustup toolchain install stable --no-self-update --profile minimal
-                  rustup target add wasm32-unknown-unknown
-
-            - name: Set up Rust cache
-              uses: swatinem/rust-cache@v2
+              uses: actions-rust-lang/setup-rust-toolchain@v1
               with:
-                  cache-on-failure: true
-                  save-if: ${{ github.ref == 'refs/heads/main' }}
+                  components: clippy, rustfmt
+                  target: wasm32-unknown-unknown
 
             - name: Install Cargo Binary Install
               uses: cargo-bins/cargo-binstall@main