Address Scorecard Token-Permissions and Pinned-Dependencies

.github/workflows/ci.yml

@@ -12,8 +12,7 @@ on:
       - closed
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 concurrency:
   group: pages-preview-${{ github.event.pull_request.number }}
@@ -22,6 +21,9 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:

.github/workflows/ossf-scorecard.yml

@@ -1,18 +1,19 @@
 name: OpenSSF Scorecard
 on:
-    push:
-        branches: [main]
-    schedule:
-        - cron: '30 4 * * 1'
-    workflow_dispatch:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '30 4 * * 1'
+  workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
-    scorecard:
-        uses: platform-mesh/.github/.github/workflows/job-ossf-scorecard.yml@f58cb68ac72e6165f845d21e5729f1037dc1eb22 # main
-        permissions:
-            security-events: write
-            id-token: write
-            contents: read
-            actions: read
+  scorecard:
+    uses: platform-mesh/.github/.github/workflows/job-ossf-scorecard.yml@f58cb68ac72e6165f845d21e5729f1037dc1eb22 # main
+    permissions:
+      security-events: write
+      id-token: write
+      contents: read
+      actions: read

.github/workflows/release.yml

@@ -8,7 +8,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
+  contents: read
 
 concurrency:
   group: pages-${{ github.ref_name }}
@@ -17,6 +17,8 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with: