fix(ci): tighten workflow GITHUB_TOKEN to least privilege (Scorecard Token-Permissions)

.github/workflows/osv-scanner-pr.yml

@@ -14,10 +14,12 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
-  # Upload SARIF to Security > Code Scanning. See github/codeql-action#2117.
+  # Scorecard Token-Permissions (alert #41): keep the workflow-level token
+  # read-only. SARIF upload needs security-events:write, but the osv-scan job
+  # below already grants it at job scope, so it is redundant (and over-broad)
+  # here.
   actions: read
   contents: read
-  security-events: write
 
 jobs:
   cancel-closed-pr-runs:

.github/workflows/pr-review-fix-scheduler.yml

@@ -90,6 +90,12 @@ concurrency:
   group: central-pr-review-fix-scheduler-${{ inputs.target_repository || vars.PR_REVIEW_FIX_TARGET_REPOSITORY || github.repository }}
   cancel-in-progress: true
 
+# Scorecard Token-Permissions (alert #8): declare a least-privilege default at
+# the workflow level. The dispatch-review-fixes job declares its own elevated
+# permissions block; the default token stays read-only.
+permissions:
+  contents: read
+
 jobs:
   dispatch-review-fixes:
     runs-on: ubuntu-latest

.github/workflows/pr-review-merge-scheduler.yml

@@ -127,6 +127,13 @@ concurrency:
     github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request_target' || github.event_name == 'workflow_dispatch' }}
 
+# Scorecard Token-Permissions (alert #9): declare a least-privilege default at
+# the workflow level. The scan-pr-queue job that actually needs write access
+# declares its own elevated permissions block; every other job (and the default
+# token) stays read-only.
+permissions:
+  contents: read
+
 jobs:
   cancel-closed-pr-runs:
     if: github.event_name == 'pull_request_target' && github.event.action == 'closed'

.github/workflows/security-scan.yml

@@ -35,10 +35,13 @@ concurrency:
   group: security-scan-${{ github.event.pull_request.base.repo.full_name || github.repository }}-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
+# Scorecard Token-Permissions (alert #42): workflow-level token stays
+# read-only. Every job that uploads SARIF (osv-scan, trivy-fs, scorecard)
+# already declares security-events:write at job scope, so granting it here as
+# well is redundant and over-broad.
 permissions:
   actions: read
   contents: read
-  security-events: write
 
 jobs:
   cancel-closed-pr-runs:

.github/workflows/strix.yml

@@ -92,12 +92,13 @@ concurrency:
   # commit. Closed PR events only cancel older runs for the same PR/head group.
   cancel-in-progress: ${{ github.event_name == 'pull_request_target' && github.event.action == 'closed' }}
 
+# Scorecard Token-Permissions (alert #43): keep the workflow-level token
+# read-only and grant the id-token/statuses writes only on the job that needs
+# them (the strix scan job below and the publish-manual-pr-evidence-status job).
 permissions:
   actions: read
   contents: read
-  id-token: write
   models: read
-  statuses: write
 
 jobs:
   cancel-closed-pr-runs:
@@ -117,6 +118,15 @@ jobs:
     # the time. Fail-closed: hitting the cap fails the run, never passes it.
     timeout-minutes: 60
     runs-on: ubuntu-latest
+    # Least-privilege token scoped to this job (Scorecard alert #43): the scan
+    # exchanges an OIDC token (id-token) and posts a commit status
+    # (statuses:write); all other scopes stay read-only.
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+      models: read
+      statuses: write
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     steps: