TPIP

Added default WF permission to read-only #33

	name: TPIP

	on:
	pull_request:
	paths:
	- '.github/workflows/tpip.yml'
	- docs/third-party-licenses.json
	- docs/tpip-header.md
	- scripts/tpip-reporter.ts
	branches:
	- main

	workflow_dispatch:

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	# Declare default permissions as read only
	permissions: read-all

	jobs:
	report:
	permissions:
	contents: write # for Git to git push
	name: Generate report
	runs-on: ubuntu-latest
	steps:
	- name: Harden the runner (Audit all outbound calls)
	uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
	with:
	egress-policy: audit

	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	ref: ${{ github.head_ref }}

	- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
	with:
	node-version: '20'
	cache: 'yarn'

	- name: Install dependencies
	run: yarn --frozen-lockfile --prefer-offline

	- name: Generate third-party licenses report
	run: yarn run tpip:report

	- name: Commit changes
	if: false
	run: \|
	git config --local user.email "git@github.com"
	git config --local user.name "GitHub Action"
	git add TPIP.md
	git commit -m "Update third-party licenses report [skip ci]"
	git push

Provide feedback