Add minimum token permissions for all GitHub workflow files

[Copilot]

This PR addresses the OpenSSF Scorecard Token-Permissions check requirements by ensuring all GitHub workflow files have appropriate minimum token permissions.

Analysis Results

After comprehensive analysis of all 20 workflow files in .github/workflows/, I found that the repository is already fully compliant with the OpenSSF Scorecard Token-Permissions requirements:

✅ Step 1: Root-Level Permissions - Already Complete

All workflow files have correct root-level permissions:

• 19 files correctly use permissions: contents: read
• 1 file (ossf-scorecard.yml) correctly uses permissions: read-all

✅ Step 2: Regular Workflow Job Permissions - Already Complete

All regular workflow jobs that require additional permissions already have them properly configured:

• Jobs needing contents: write (e.g., for releases, backports) already have it
• Jobs needing pull-requests: write (e.g., for PR operations) already have it
• Jobs needing issues: write (e.g., for issue management) already have it

✅ Step 3: Local Reusable Workflow Permissions - Already Complete

Jobs calling local reusable workflows have appropriate permissions:

• Most reusable workflows only need contents: read (provided at root level)
• The workflow-notification job in owasp-dependency-check-daily.yml correctly has issues: write permission for the reusable-workflow-notification.yml workflow

Verification

I created comprehensive analysis scripts to verify compliance across all workflows and confirmed that:

• All root-level permissions follow the required format
• All job-level permissions are correctly scoped to actual needs
• All reusable workflow calls have sufficient permissions

Conclusion

No code changes were required as this repository already implements security best practices for GitHub Actions token permissions. This analysis serves as documentation that the codebase is compliant with OpenSSF Scorecard recommendations.

Fixes #87.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.