ci: fix ghalint

Author: guitarrapc

.github/workflows/build-debug.yml .github/workflows/build-debug.yaml.github/workflows/build-debug.yml renamed to .github/workflows/build-debug.yaml

@@ -11,7 +11,9 @@ on:
 
 jobs:
   build-dotnet:
-    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - uses: Cysharp/Actions/.github/actions/checkout@main
@@ -25,7 +27,9 @@ jobs:
       fail-fast: false
       matrix:
         unity: ["2022.3.39f1", "6000.0.12f1"] # Test with LTS
-    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
       - name: Load secrets

.github/workflows/build-release.yml .github/workflows/build-release.yaml.github/workflows/build-release.yml renamed to .github/workflows/build-release.yaml

@@ -14,6 +14,8 @@ on:
 
 jobs:
   update-packagejson:
+    permissions:
+      contents: write
     uses: Cysharp/Actions/.github/workflows/update-packagejson.yaml@main
     with:
       file-path: |
@@ -24,7 +26,9 @@ jobs:
 
   build-dotnet:
     needs: [update-packagejson]
-    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - run: echo ${{ needs.update-packagejson.outputs.sha }}
@@ -47,7 +51,9 @@ jobs:
     strategy:
       matrix:
         unity: ["2022.3.39f1"]
-    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
       - name: Load secrets
@@ -95,6 +101,8 @@ jobs:
   # release
   create-release:
     needs: [update-packagejson, build-dotnet, build-unity]
+    permissions:
+      contents: write
     uses: Cysharp/Actions/.github/workflows/create-release.yaml@main
     with:
       dry-run: ${{ inputs.dry-run }}
@@ -107,6 +115,8 @@ jobs:
   cleanup:
     if: ${{ needs.update-packagejson.outputs.is-branch-created == 'true' }}
     needs: [update-packagejson, create-release]
+    permissions:
+      contents: write
     uses: Cysharp/Actions/.github/workflows/clean-packagejson-branch.yaml@main
     with:
       branch: ${{ needs.update-packagejson.outputs.branch-name }}

.github/workflows/stale.yml .github/workflows/stale.yaml.github/workflows/stale.yml renamed to .github/workflows/stale.yaml

@@ -7,4 +7,8 @@ on:
 
 jobs:
   stale:
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
     uses: Cysharp/Actions/.github/workflows/stale-issue.yaml@main