ci: tighten workflow permissions and resolve event file path

Agent-Logs-Url: https://github.com/fsprojects/FSharp.Data.GraphQL/sessions/ae314b8b-9c8a-4f87-a8b0-b77c4bfa2cef

Co-authored-by: xperiandri <2365592+xperiandri@users.noreply.github.com>

Author: Copilot

.github/workflows/publish-test-results.yml

@@ -34,10 +34,24 @@ jobs:
         path: test-results
         pattern: test-results-*
 
+    - name: Resolve event file path
+      id: event_file
+      shell: pwsh
+      run: |
+        $eventFilePath =
+          Get-ChildItem -Path artifacts -Filter event.json -Recurse |
+          Select-Object -First 1 -ExpandProperty FullName
+
+        if ($null -eq $eventFilePath) {
+          throw "event.json file was not found in downloaded artifacts"
+        }
+
+        "path=$eventFilePath" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append
+
     - name: Publish test results
       uses: EnricoMi/publish-unit-test-result-action@v2
       with:
         commit: ${{ github.event.workflow_run.head_sha }}
-        event_file: artifacts/event.json
+        event_file: ${{ steps.event_file.outputs.path }}
         event_name: ${{ github.event.workflow_run.event }}
         files: "test-results/**/*.trx"

.github/workflows/pull-request.yml

@@ -14,11 +14,15 @@ env:
   DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1
   DOTNET_NOLOGO: true
 
+permissions: {}
+
 jobs:
   event_file:
     if: github.event_name == 'pull_request'
     name: Publish event file
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - name: Upload event file
       uses: actions/upload-artifact@v4
@@ -27,6 +31,8 @@ jobs:
         path: ${{ github.event_path }}
 
   build:
+    permissions:
+      contents: read
 
     strategy:
       fail-fast: false