Fix zizmor lints.

.github/workflows/release.yml

@@ -4,29 +4,31 @@ on:
   push:
     tags: ["[0-9]+.[0-9]+.[0-9]+*"]
 
-permissions:
-  contents: write
-
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  REF_NAME: ${{ github.ref_name }}
 
 jobs:
   create:
     name: create release
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{ github.ref_name }}
+          ref: "$REF_NAME"
           persist-credentials: false
       - name: verify version matches
         shell: bash
-        run: grep -q 'version = "${{ github.ref_name }}"' Cargo.toml || { echo version mismatch >&2 && exit 1; }
+        run: grep -q "version = $REF_NAME" Cargo.toml || { echo version mismatch >&2 && exit 1; }
       - name: create release
-        run: gh release create ${{ github.ref_name }} --draft --verify-tag --title ${{ github.ref_name }}
+        run: gh release create "$REF_NAME" --draft --verify-tag --title "$REF_NAME"
 
   build_bin:
     name: build binary
+    permissions:
+      contents: write
     needs: ['create']
     runs-on: ${{ matrix.os }}
     strategy:
@@ -50,7 +52,7 @@ jobs:
     - name: checkout
       uses: actions/checkout@v4
       with:
-        ref: ${{ github.ref_name }}
+        ref: "$REF_NAME"
         persist-credentials: false
 
     - name: install rust
@@ -77,7 +79,7 @@ jobs:
 
     - name: set archive name
       shell: bash
-      run: echo "ARCHIVE=jotdown-${{ github.ref_name }}-${{ matrix.target }}" >> $GITHUB_ENV
+      run: echo "ARCHIVE=jotdown-"$REF_NAME"-${{ matrix.target }}" >> $GITHUB_ENV
 
     - name: init archive dir
       shell: bash
@@ -103,17 +105,19 @@ jobs:
     - name: Upload release archive
       shell: bash
       run: |
-        gh release upload ${{ github.ref_name }} ${{ env.ASSET }}
+        gh release upload "$REF_NAME" "$ASSET"
 
   build_wasm:
     name: build wasm lib
+    permissions:
+      contents: write
     needs: ['create']
     runs-on: ubuntu-latest
     steps:
     - name: checkout
       uses: actions/checkout@v4
       with:
-        ref: ${{ github.ref_name }}
+        ref: "$REF_NAME"
         persist-credentials: false
 
     - name: install toolchain
@@ -131,5 +135,5 @@ jobs:
     - name: upload
       shell: bash
       run: |
-        gh release upload ${{ github.ref_name }} examples/jotdown_wasm/pkg/jotdown_wasm_bg.wasm
-        gh release upload ${{ github.ref_name }} examples/jotdown_wasm/pkg/jotdown_wasm.js
+        gh release upload "$REF_NAME" examples/jotdown_wasm/pkg/jotdown_wasm_bg.wasm
+        gh release upload "$REF_NAME" examples/jotdown_wasm/pkg/jotdown_wasm.js