security: minimize GitHub Actions permissions (#91)

Apply least-privilege principle to all 12 workflow files:
- Set workflow-level permissions to {} (no default permissions)
- Add explicit job-level permissions for each job
- Ensure only contents:read for most jobs
- Maintain necessary write permissions for publish/security workflows
This change follows the zero-trust security model by:
1. Removing overly permissive read-all at workflow level
2. Granting minimum required permissions per job
3. Preventing accidental privilege escalation for new jobs

🖥️ IDE: [Cursor](https://cursor.sh)
🔌 Extension: [Claude Code](https://claude.ai/download)


Model-Raw: claude-opus-4-5-20251101

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Author: nullvariant

.github/workflows/blaze-bot.yml

@@ -3,7 +3,7 @@
 
 name: 🐗 Blaze Bot
 
-permissions: read-all
+permissions: {}
 
 on:
   workflow_dispatch:
@@ -17,6 +17,8 @@ jobs:
   blaze-commit:
     name: 🐗 Charge forward!
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: 🐗 Get fired up!

.github/workflows/ci.yml

@@ -8,11 +8,13 @@ on:
     branches:
       - main
 
-permissions: read-all
+permissions: {}
 
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout
@@ -59,6 +61,8 @@ jobs:
   e2e:
     name: E2E Tests (VS Code Extension)
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     continue-on-error: true
 
     steps:

.github/workflows/ciel-bot.yml

@@ -3,7 +3,7 @@
 
 name: 🕊️ Ciel Bot
 
-permissions: read-all
+permissions: {}
 
 on:
   workflow_dispatch:
@@ -17,6 +17,8 @@ jobs:
   ciel-commit:
     name: 🕊️ Descend from the sky
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: 🕊️ Arrive gracefully

.github/workflows/deploy-docs.yml

@@ -14,11 +14,13 @@ on:
       - 'extensions/git-id-switcher/docs/**'      # All language READMEs + docs
   workflow_dispatch:  # Manual trigger
 
-permissions: read-all
+permissions: {}
 
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     # Prevent forks from deploying (no Cloudflare secrets)
     if: github.repository == 'nullvariant/nullvariant-vscode-extensions'
 

.github/workflows/generate-readme.yml

@@ -7,7 +7,7 @@ on:
       - 'extensions/git-id-switcher/README.md'
   workflow_dispatch:  # Manual trigger for verification
 
-permissions: read-all
+permissions: {}
 
 # README auto-generation is handled by local pre-commit hook (husky)
 # This workflow only verifies sync as a safety net
@@ -16,6 +16,8 @@ jobs:
   check-sync:
     name: Verify README is in sync
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout

.github/workflows/justice-bot.yml

@@ -3,7 +3,7 @@
 
 name: 👮 Justice Bot
 
-permissions: read-all
+permissions: {}
 
 on:
   workflow_dispatch:
@@ -17,6 +17,8 @@ jobs:
   justice-commit:
     name: 👮 Enforce the law
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: 👮 Begin inspection

.github/workflows/luna-bot.yml

@@ -3,7 +3,7 @@
 
 name: 👧 Luna Bot
 
-permissions: read-all
+permissions: {}
 
 on:
   workflow_dispatch:
@@ -17,6 +17,8 @@ jobs:
   luna-commit:
     name: 👧 Explore and discover
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: 👧 Start exploring

.github/workflows/mimi-bot.yml

@@ -3,7 +3,7 @@
 
 name: 🐰 Mimi Bot
 
-permissions: read-all
+permissions: {}
 
 on:
   workflow_dispatch:
@@ -17,6 +17,8 @@ jobs:
   mimi-commit:
     name: 🐰 Listen carefully
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: 🐰 Perk up ears

.github/workflows/publish.yml

@@ -5,7 +5,7 @@ on:
     tags:
       - 'git-id-switcher-v*'
 
-permissions: read-all
+permissions: {}
 
 jobs:
   publish:

.github/workflows/security.yml

@@ -14,12 +14,14 @@ on:
   branch_protection_rule:
   workflow_dispatch:
 
-permissions: read-all
+permissions: {}
 
 jobs:
   security-audit:
     name: Security Audit
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: extensions/git-id-switcher
@@ -48,6 +50,8 @@ jobs:
   lint-security:
     name: Security Linting
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: extensions/git-id-switcher
@@ -88,6 +92,8 @@ jobs:
   security-tests:
     name: Security Tests
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: extensions/git-id-switcher
@@ -146,6 +152,7 @@ jobs:
     # Only run on main branch (push, schedule) - not on PRs
     if: github.event_name != 'pull_request'
     permissions:
+      contents: read
       security-events: write
       id-token: write