defi.yml + abi.yml: contents:read perms, persist-credentials false (security/LOW)

- Both workflows now declare `permissions: contents: read` at the
  workflow level. defi.yml is read-mostly CI; abi.yml uses the
  env-scoped NPM_TOKEN_ORIGIN_DEFI for the publish step (not
  GITHUB_TOKEN).
- Every actions/checkout step in both workflows now
  `with: { persist-credentials: false }` so the runner-side token
  isn't left in .git/config for later steps to read.

No behavior change — none of the jobs push to the repo.

Author: apexearth

.github/workflows/abi.yml

@@ -8,13 +8,21 @@ concurrency:
   cancel-in-progress: true
   group: ${{ github.ref_name }}
 
+# security/LOW: scope GITHUB_TOKEN to read-only. Publishes use
+# NPM_TOKEN_ORIGIN_DEFI (env-scoped to `master` environment), not
+# GITHUB_TOKEN.
+permissions:
+  contents: read
+
 jobs:
   abi-gen:
     name: "Generate and publish ABI"
     runs-on: ubuntu-latest
     environment: master
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install pnpm
         uses: pnpm/action-setup@v4

.github/workflows/defi.yml

@@ -13,12 +13,19 @@ concurrency:
   cancel-in-progress: true
   group: ${{ github.ref_name }}
 
+# security/LOW: scope GITHUB_TOKEN to read-only. None of the jobs in
+# this workflow push to the repo or comment on PRs.
+permissions:
+  contents: read
+
 jobs:
   contracts-lint:
     name: "Contracts Linter"
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install pnpm
         uses: pnpm/action-setup@v4
@@ -57,6 +64,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install pnpm
         uses: pnpm/action-setup@v4
@@ -95,6 +104,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install pnpm
         uses: pnpm/action-setup@v4
@@ -135,6 +146,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install pnpm
         uses: pnpm/action-setup@v4
@@ -189,6 +202,8 @@ jobs:
           --health-retries 10
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install pnpm
         uses: pnpm/action-setup@v4
@@ -236,6 +251,8 @@ jobs:
       MAX_CHUNKS: "4"
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install pnpm
         uses: pnpm/action-setup@v4
@@ -286,6 +303,8 @@ jobs:
       ARBITRUM_PROVIDER_URL: ${{ secrets.ARBITRUM_PROVIDER_URL }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install pnpm
         uses: pnpm/action-setup@v4
@@ -336,6 +355,8 @@ jobs:
       BASE_PROVIDER_URL: ${{ secrets.BASE_PROVIDER_URL }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install pnpm
         uses: pnpm/action-setup@v4
@@ -386,6 +407,8 @@ jobs:
       SONIC_PROVIDER_URL: ${{ secrets.SONIC_PROVIDER_URL }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install pnpm
         uses: pnpm/action-setup@v4
@@ -436,6 +459,8 @@ jobs:
       PLUME_PROVIDER_URL: ${{ secrets.PLUME_PROVIDER_URL }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install pnpm
         uses: pnpm/action-setup@v4
@@ -486,6 +511,8 @@ jobs:
       HYPEREVM_PROVIDER_URL: ${{ secrets.HYPEREVM_PROVIDER_URL }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install pnpm
         uses: pnpm/action-setup@v4
@@ -543,6 +570,8 @@ jobs:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - uses: actions/cache@v4
         id: hardhat-cache
@@ -565,6 +594,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Set up Python 3.10
         uses: actions/setup-python@v5