Tighten GitHub Actions checkout usage

.github/workflows/cmake.yml

@@ -2,6 +2,9 @@ name: CMake build
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   assertion-handler:
     name: Custom assertion handler (${{ matrix.build_type }})
@@ -118,7 +121,8 @@ jobs:
     steps:
     - name: Checkout ${{ github.ref_name }}
       uses: actions/checkout@v7
-    - run: git submodule update --init --recursive
+      with:
+        submodules: recursive
     - name: set extra GITHUB_PATH ${{ matrix.config.extra_path }} (for MinGW)
       shell: bash
       run: echo "${{ matrix.config.extra_path }}" >> $GITHUB_PATH

.github/workflows/cmake_builtin_lib.yml

@@ -2,6 +2,9 @@ name: CMake SQLite3 builtin library
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: ${{ matrix.config.name }}
@@ -24,7 +27,8 @@ jobs:
     steps:
     - name: Checkout ${{ github.ref_name }}
       uses: actions/checkout@v7
-    - run: git submodule update --init --recursive
+      with:
+        submodules: recursive
     - run: mkdir build
     - run: cmake -G "Unix Makefiles" -DCMAKE_VERBOSE_MAKEFILE=ON -DCMAKE_BUILD_TYPE=Debug -DSQLITECPP_INTERNAL_SQLITE=OFF -DSQLITE_OMIT_LOAD_EXTENSION=ON -DSQLITECPP_BUILD_TESTS=ON -DSQLITECPP_BUILD_EXAMPLES=ON -DSQLITECPP_RUN_CPPCHECK=OFF -DSQLITECPP_RUN_CPPLINT=OFF .. 
       working-directory: build

.github/workflows/cmake_policy_4_4.yml

@@ -2,6 +2,9 @@ name: Latest CMake / 4.4 policies
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: ${{ matrix.os }}

.github/workflows/cmake_standards.yml

@@ -2,6 +2,9 @@ name: CMake C++17/C++20 standards
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: C++${{ matrix.library_standard }} library / C++${{ matrix.consumer_standard }} consumer

.github/workflows/cmake_subdir_example.yml

@@ -2,6 +2,9 @@ name: CMake build of example in subdirectory
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: ${{ matrix.config.name }}

.github/workflows/codeql.yml

@@ -23,7 +23,6 @@ jobs:
     steps:
     - name: Checkout ${{ github.ref_name }}
       uses: actions/checkout@v7
-    - run: git submodule update --init --recursive
 
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v4

.github/workflows/coverage.yml

@@ -2,6 +2,9 @@ name: Coverage
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   coverage:
     name: Ubuntu GCC GCov Coverage
@@ -10,7 +13,8 @@ jobs:
     steps:
     - name: Checkout ${{ github.ref_name }}
       uses: actions/checkout@v7
-    - run: git submodule update --init --recursive
+      with:
+        submodules: recursive
 
     - name: Install lcov
       run: sudo apt-get update && sudo apt-get install -y lcov

.github/workflows/coverity.yml

@@ -8,6 +8,9 @@ on:
     branches: [master]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   coverity:
     name: Ubuntu GCC Coverity Scan
@@ -17,7 +20,6 @@ jobs:
     steps:
     - name: Checkout ${{ github.ref_name }}
       uses: actions/checkout@v7
-    - run: git submodule update --init --recursive
 
     - run: mkdir build
 

.github/workflows/meson.yml

@@ -2,6 +2,9 @@ name: Meson build
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: (Meson) ${{ matrix.config.name }}

.github/workflows/quality.yml

@@ -23,7 +23,8 @@ jobs:
     steps:
     - name: Checkout ${{ github.ref_name }}
       uses: actions/checkout@v7
-    - run: git submodule update --init --recursive
+      with:
+        submodules: recursive
 
     - name: Configure
       env:
@@ -55,7 +56,6 @@ jobs:
     steps:
     - name: Checkout ${{ github.ref_name }}
       uses: actions/checkout@v7
-    - run: git submodule update --init --recursive
 
     - name: Install cppcheck
       run: sudo apt-get update && sudo apt-get install -y cppcheck