Verify GitHub workflow files comply with minimum token permissions requirements

[Copilot]

This PR addresses the Token-Permissions check from OpenSSF Scorecard recommendations by verifying that all GitHub workflow files have minimum token permissions configured correctly.

Summary

After comprehensive analysis of all 20 GitHub workflow files in the repository, all workflows already comply with the security requirements. No changes were needed.

Verification Results

✅ Root-Level Permissions

• All 20 workflow files have correct root-level permissions set
• 19 files use permissions: contents: read (secure default)
• 1 file uses permissions: read-all (ossf-scorecard.yml - acceptable for scorecard workflows)

✅ Job-Level Permissions

All jobs requiring write permissions already have appropriate job-level permissions with explanatory comments:

• assign-reviewers.yml: pull-requests: write # for assigning reviewers
• backport.yml: contents: write # for Git to git push
• codeql.yml: security-events: write # for github/codeql-action/analyze to upload SARIF results
• issue-management-stale-action.yml: issues: write # for actions/stale to close stale issues
• prepare-patch-release.yml: contents: write # for Git to git push
• prepare-release-branch.yml: contents: write # for Git to git push
• release.yml: contents: write # for creating the release

✅ Local Reusable Workflow Calls

• build.yml calls 4 reusable workflows that only need contents: read
• owasp-dependency-check-daily.yml calls reusable workflow with correct issues: write permissions

Security Compliance

This verification ensures compliance with OpenSSF Scorecard Token-Permissions check:

• ✅ All workflows have minimum required root-level permissions
• ✅ Write permissions are granted only where necessary at job level
• ✅ All write permissions have explanatory comments
• ✅ No unnecessary permissions granted

Fixes #79.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.