ci: fix ghalint

Author: guitarrapc

.github/workflows/benchmark.yml renamed to .github/workflows/benchmark.yaml

@@ -21,10 +21,10 @@ on:
 
 jobs:
   benchmark:
-    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    runs-on: ubuntu-24.04
     timeout-minutes: 360 # Default: 360 minutes
-    strategy:
-      fail-fast: true
     steps:
       - uses: Cysharp/Actions/.github/actions/checkout@main
       - uses: Cysharp/Actions/.github/actions/setup-dotnet@main

.github/workflows/build-debug.yml renamed to .github/workflows/build-debug.yaml

@@ -10,11 +10,13 @@ on:
 
 jobs:
   build-dotnet:
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 10
     strategy:
       matrix:
-        os: [ubuntu-latest, windows-latest]
+        os: [ubuntu-24.04, windows-latest]
+    permissions:
+      contents: read
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
     steps:
       - uses: Cysharp/Actions/.github/actions/checkout@main
       - uses: Cysharp/Actions/.github/actions/setup-dotnet@main
@@ -24,7 +26,10 @@ jobs:
       - run: dotnet test  -c Release tests/System.Linq.Tests/System.Linq.Tests.slnx --no-build
 
   check-codecov-token:
-    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
     outputs:
       run_codecoverage: ${{ steps.check-token.outputs.token_exists }}
     steps:
@@ -45,7 +50,9 @@ jobs:
   code-coverage:
     if: ${{ needs.check-codecov-token.outputs.run_codecoverage == 'true' }} # secrets can't referenced in `if` so it needs separate job.
     needs: check-codecov-token
-    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
     steps:
       - uses: Cysharp/Actions/.github/actions/checkout@main
@@ -68,13 +75,13 @@ jobs:
           $sessionId = 'ZLinq'
 
           dotnet coverage collect --session-id $sessionId --nologo --settings codecoverage.runsettings --server-mode --background
-          try 
+          try
           {
             dotnet coverage connect $sessionId --nologo "dotnet test ../ -c Release --framework net9.0 --no-build"
-            
+
             dotnet coverage connect $sessionId --nologo "dotnet test -c Release System.Linq.Tests/System.Linq.Tests.slnx --framework net9.0 --no-build"
           }
-          finally 
+          finally
           {
             dotnet coverage shutdown $sessionId --nologo --timeout 60000
           }

.github/workflows/build-release.yml renamed to .github/workflows/build-release.yaml

@@ -14,6 +14,8 @@ on:
 
 jobs:
   update-packagejson:
+    permissions:
+      contents: write
     uses: Cysharp/Actions/.github/workflows/update-packagejson.yaml@main
     with:
       file-path: |
@@ -23,7 +25,9 @@ jobs:
 
   build-dotnet:
     needs: [update-packagejson]
-    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - uses: Cysharp/Actions/.github/actions/checkout@main
@@ -41,6 +45,8 @@ jobs:
   # release
   create-release:
     needs: [update-packagejson, build-dotnet]
+    permissions:
+      contents: write
     uses: Cysharp/Actions/.github/workflows/create-release.yaml@main
     with:
       commit-id: ${{ needs.update-packagejson.outputs.sha }}
@@ -53,6 +59,8 @@ jobs:
   cleanup:
     if: ${{ needs.update-packagejson.outputs.is-branch-created == 'true' }}
     needs: [update-packagejson, build-dotnet]
+    permissions:
+      contents: write
     uses: Cysharp/Actions/.github/workflows/clean-packagejson-branch.yaml@main
     with:
       branch: ${{ needs.update-packagejson.outputs.branch-name }}

.github/workflows/stale.yml renamed to .github/workflows/stale.yaml

@@ -7,4 +7,8 @@ on:
 
 jobs:
   stale:
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
     uses: Cysharp/Actions/.github/workflows/stale-issue.yaml@main