ci: 🔒 Scope token on GH workflows

.github/workflows/build.yaml

@@ -13,11 +13,13 @@
 
 permissions:
   contents: read
-  packages: write
 
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write  # push images to ghcr.io
 
     strategy:
       matrix:
@@ -117,7 +119,7 @@
             # Always use the computed tag
             type=raw,value=${{ steps.tag.outputs.tag }}
             # Add 'latest' tag for version tags, workflow_dispatch, and pushes to main
             type=raw,value=latest,enable=${{ (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main' }}
 
       # 6b. Resolve build-args. authbridge-cpex needs CPEX_FFI_VERSION
       # (the release tag) and CPEX_FFI_ABI (the FFI ABI integer the

.github/workflows/dependabot-tidy.yml

@@ -14,8 +14,7 @@ on:
       - "authbridge/**/go.sum"
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 # A Dependabot force-push (rebase) landing while a tidy is in flight would
 # otherwise produce two jobs racing to push the same ref; the loser fails
@@ -29,6 +28,9 @@ jobs:
     if: github.actor == 'dependabot[bot]'
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    permissions:
+      contents: write        # push tidy commit to the Dependabot PR branch
+      pull-requests: write   # close+reopen the PR to re-trigger CI
     env:
       GOWORK: "off"
       GOTOOLCHAIN: local

.github/workflows/self-assign.yml

@@ -13,10 +13,12 @@ on:
 
 permissions:
   contents: read
-  issues: write
 
 jobs:
   self-assign:
+    permissions:
+      contents: read
+      issues: write  # assign the commenter to the issue
     uses: rossoctl/.github/.github/workflows/self-assign-reusable.yml@main
     secrets:
       ISSUE_ASSIGN_TOKEN: ${{ secrets.ISSUE_ASSIGN_TOKEN }}

.github/workflows/spellcheck_action.yml

@@ -8,6 +8,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   spellcheck:
     # disable spell check with 'false' value.

.github/workflows/stale.yaml

@@ -13,9 +13,12 @@ on:
   workflow_dispatch:
 
 permissions:
-  issues: write
-  pull-requests: write
+  contents: read
 
 jobs:
   stale:
+    permissions:
+      contents: read
+      issues: write         # close stale issues
+      pull-requests: write  # close stale PRs
     uses: rossoctl/.github/.github/workflows/stale.yaml@main