github: fixes tokens for scanners

Author: kikofernandez

.github/workflows/openvex-sync.yml

@@ -35,8 +35,6 @@ jobs:
   run-scheduled-openvex-sync:
     runs-on: ubuntu-latest
     permissions:
-      security-events: read # use inside the otp-compliance.es as API call
-      actions: write        # use inside the otp-compliance.es
       contents: write       # use inside the otp-compliance.es
       pull-requests: write  # use inside the otp-compliance.es
     if: github.repository == 'erlang/otp'
@@ -61,8 +59,7 @@ jobs:
           app-id: ${{ vars.ERLANG_BOT_APP_ID }}
           private-key: ${{ secrets.ERLANG_BOT_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
-          permission-security-events: read
-          permission-actions: write
+          repositories: otp
           permission-contents: write
           permission-pull-requests: write
 

.github/workflows/reusable-vendor-vulnerability-scanner.yml

@@ -155,9 +155,8 @@ jobs:
           app-id: ${{ secrets.ERLANG_VENDOR_SCANNER_APP_ID }}
           private-key: ${{ secrets.ERLANG_VENDOR_SCANNER_BOT_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
+          repositories: otp
           permission-issues: write
-          permission-content: read
-          permission-actions: write
 
       # PRs comming from a fork can use their own GH_TOKEN instead.
       # this is for security reasons that forked PRs cannot work with Github App tokens

.github/workflows/sigstore-updater.yml

@@ -147,9 +147,9 @@ jobs:
           app-id: ${{ vars.ERLANG_BOT_APP_ID }}
           private-key: ${{ secrets.ERLANG_BOT_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
-          permission-issues: write
-          permission-content: read
-          permission-actions: write
+          repositories: otp
+          permission-contents: write
+          permission-pull-requests: write
       - name: Authenticate gh
         if: steps.changed.outputs.found == 'true'
         env: