fix: restrict GITHUB_TOKEN permissions (Scorecard alerts #26, #27)

[Copilot]

Two Scorecard Token-Permissions alerts flagged overly broad GITHUB_TOKEN scopes violating least-privilege.

Changes

.github/workflows/ci.yml

• Removed security-events: write from the security job — TruffleHog in this workflow does not upload SARIF, so the write permission served no purpose.

.github/workflows/scorecard.yml

• Added permissions: read-all at the workflow top-level. Job-level write permissions (security-events: write, id-token: write) remain, scoped only to the job that requires them.

# scorecard.yml — before: no top-level permissions block
permissions: read-all   # added

jobs:
  analysis:
    permissions:
      security-events: write
      id-token: write

[Copilot]

Pull request overview

This PR tightens GitHub Actions GITHUB_TOKEN permissions to address OpenSSF Scorecard Token-Permissions alerts by reducing unnecessary write scopes and making defaults explicit.

Changes:

• Add a workflow-level permissions: read-all default to the Scorecard workflow.
• Remove unused security-events: write from the CI workflow’s security job.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/scorecard.yml	Adds workflow-level default token permissions (read-all) for least-privilege alignment.
.github/workflows/ci.yml	Removes unnecessary security-events: write from the security job permissions.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Added contents: read to the analysis job-level permissions block in commit Add contents: read to scorecard analysis job permissions.