chore: align GitHub standards and repo metadata

[ramtamilselvan]

This rollout aligns the repository with the Foundation GitHub standards bundle, repo-role metadata, and current public source-of-truth model.

In general, the fix is to explicitly add a permissions block that grants only the minimal required scopes for the GITHUB_TOKEN. For this workflow, the job just checks out the repository and runs a local search; it does not need to write anything back to GitHub or access issues, PRs, or other resources. The minimal practical permission is contents: read, which allows actions/checkout to function while keeping the token read‑only.

The best fix without changing existing functionality is to add a permissions block at the workflow root (top level, alongside name, on, and jobs) so it applies to all jobs in this workflow. Insert it between the on: block and jobs: block in .github/workflows/docs-hygiene.yml, with contents: read. No other permissions are needed, and no changes to steps are required. No imports or additional methods are involved because this is a YAML configuration file.

In general, fix this by adding an explicit permissions block to the workflow (either at the top level or for each job) that grants only the scopes actually required. For read‑only workflows that just check out code and run analyses/tests, permissions: contents: read at the workflow level is a good minimal baseline; additional scopes can be added only if strictly needed.

For this specific file, the simplest and most accurate fix is to define a workflow‑level permissions block just under the name: and before on:. None of the jobs in this workflow pushes commits, creates releases, or modifies issues/PRs, and actions/upload-artifact does not use GITHUB_TOKEN for repo writes, so contents: read is sufficient. This will apply to all jobs (repo-inventory, sbom, quick-tests) without altering their behavior, and will satisfy CodeQL’s requirement that the GITHUB_TOKEN permissions be explicitly restricted.

Concretely: in .github/workflows/repo-security-baseline.yml, insert:

permissions:
  contents: read

between line 1 (name: Repo Security Baseline) and line 3 (on:). No imports or other definitions are needed.

To fix the problem, explicitly restrict the GITHUB_TOKEN permissions to the minimum required by these jobs. All three jobs only need to read the repository contents and upload an artifact; they do not push commits, create releases, modify issues, or change workflow files. The minimal reasonable scope is contents: read at the workflow level, which applies to all jobs. No job requires elevated or write permissions.

The best fix is to add a permissions block at the root level of .github/workflows/repo-security-baseline.yml, alongside name and on, so it applies to all jobs that don’t override it. Add:

permissions:
  contents: read

This should be placed after the name: line (or before on:), keeping indentation consistent with other top-level keys. No imports or additional methods are needed because this is purely a YAML configuration change. No further functionality changes are required.

In general, the fix is to declare an explicit permissions block limiting the GITHUB_TOKEN to the minimal scopes needed. For this workflow, all jobs only need to read repository contents and upload artifacts; no job modifies repository state or interacts with issues/PRs.

The single best fix is to add a root-level permissions block near the top of .github/workflows/repo-security-baseline.yml (e.g., after name: and before on:) with contents: read. This will apply to all jobs (repo-inventory, sbom, and quick-tests) since none define their own permissions. No additional scopes (like pull-requests: write or contents: write) are required because the steps only check out code, run tools, and upload artifacts, all of which work with contents: read. No imports or other definitions are needed because this is a YAML configuration change only.