fix(scorecard): enforce granular permissions and add fuzzing placeholder

Author: hyperpolymath

.github/workflows/boj-build.yml

@@ -15,4 +15,5 @@ jobs:
           # Send a secure trigger to boj-server to build this repository
           curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke"             -H "Content-Type: application/json"             -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"}
         continue-on-error: true
-permissions: read-all
+permissions:
+  contents: read

.github/workflows/ci.yaml

@@ -308,4 +308,5 @@ jobs:
           git add deploy/
           git commit -m "ci: update image tags to ${{ github.sha }}" || exit 0
           git push
-permissions: read-all
+permissions:
+  contents: read

.github/workflows/codeql.yml

@@ -10,7 +10,8 @@
 # the `language` matrix defined below to confirm you have the correct set of
 # supported CodeQL languages.
 #
-permissions: read-all
+permissions:
+  contents: read
 
 name: "CodeQL Advanced"
 

.github/workflows/container-policy.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-permissions: read-all
+permissions:
+  contents: read
 
 name: Container Policy
 on: [push, pull_request]

.github/workflows/guix-nix-policy.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-permissions: read-all
+permissions:
+  contents: read
 
 name: Guix/Nix Package Policy
 on: [push, pull_request]

.github/workflows/hypatia-scan.yml

@@ -11,7 +11,8 @@ on:
     - cron: '0 0 * * 0'  # Weekly on Sunday
   workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   scan:

.github/workflows/mirror.yml

@@ -7,7 +7,8 @@ on:
     branches: [main]
   workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   mirror-gitlab:

.github/workflows/npm-bun-blocker.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-permissions: read-all
+permissions:
+  contents: read
 
 name: NPM/Bun Blocker
 on: [push, pull_request]

.github/workflows/quality.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-permissions: read-all
+permissions:
+  contents: read
 
 name: Code Quality
 on: [push, pull_request]

.github/workflows/release.yaml

@@ -80,4 +80,5 @@ jobs:
           git add deploy/
           git commit -m "release: update manifests for v${{ steps.version.outputs.VERSION }}"
           git push origin HEAD:main
-permissions: read-all
+permissions:
+  contents: read