ci: port zizmor audit hardening to next (backport of #4200) (#4310)

Applies the GitHub Actions security hardening from #4200 (main) to the
next branch's reworked workflows:

- Add top-level least-privilege `permissions: {}` to ci.yml, release.yml
  and gh-pages.yml, with scoped `permissions:` on jobs that need write
  access (the release publish job's existing contents/id-token trusted
  publishing permissions are preserved).
- Add `persist-credentials: false` to every actions/checkout step.
- Avoid expression injection in the release step by passing the version
  through an environment variable.
- Mark the add-to-project pull_request_target trigger with a zizmor
  dangerous-triggers ignore.
- Add a dependabot cooldown (default-days: 7).

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Samuel Attard <sattard@anthropic.com>
Co-authored-by: David Sanders <dsanders11@ucsbalum.com>

Author: 4 people

.github/dependabot.yml

@@ -4,3 +4,5 @@ updates:
     directory: '/'
     schedule:
       interval: 'monthly'
+    cooldown:
+      default-days: 7

.github/workflows/add-to-project.yml

@@ -4,7 +4,7 @@ on:
   issues:
     types:
       - opened
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types:
       - opened
 

.github/workflows/ci.yml

@@ -12,6 +12,8 @@ on:
     types: [checks_requested]
   workflow_call:
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
@@ -25,6 +27,8 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
@@ -72,6 +76,8 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
@@ -149,6 +155,8 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0

.github/workflows/gh-pages.yml

@@ -6,9 +6,13 @@ on:
     tags:
       - v7.**
 
+permissions: {}
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}
     steps:
@@ -23,6 +27,7 @@ jobs:
           submodules: true
           fetch-depth: 0
           token: ${{ steps.generate-token.outputs.token }}
+          persist-credentials: false
 
       - name: Get short SHA for HEAD
         id: get-short-sha

.github/workflows/release.yml

@@ -5,17 +5,22 @@ on:
     branches:
       - next
 
+permissions: {}
+
 jobs:
   check-release-criteria:
     name: Check Release Criteria
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       should_release: ${{ steps.check.outputs.should_release }}
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 2
+          persist-credentials: false
 
       - name: Check release criteria
         id: check
@@ -94,6 +99,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
@@ -123,4 +130,5 @@ jobs:
       - name: Create GitHub release
         env:
           GH_TOKEN: ${{ fromJSON(steps.secret-service.outputs.secrets).GITHUB_TOKEN }}
-        run: gh release create "v${{ steps.version.outputs.version }}" --target ${{ github.sha }} --generate-notes --prerelease
+          STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}
+        run: gh release create "v${STEPS_VERSION_OUTPUTS_VERSION}" --target ${{ github.sha }} --generate-notes --prerelease