Update workflow permissions to remove 'read-all' and set to empty for… (#750)

* Update workflow permissions to remove 'read-all' and set to empty for consistency

* Fix Dependabot auto-merge trigger to specify main branch for pull requests

Author: frasermolyneux

.github/workflows/build-and-test.yml

@@ -7,8 +7,7 @@ on:
       - "bugfix/**"
       - "hotfix/**"
 
-
-permissions: read-all
+permissions: {}
 
 jobs:
   build-and-test:

.github/workflows/codequality.yml

@@ -10,9 +10,8 @@ on:
     branches:
       - main
     types: [opened, synchronize, reopened, ready_for_review]
-
-  
-permissions: read-all
+ 
+permissions: {}
 
 jobs:
   quality:
@@ -36,6 +35,7 @@ jobs:
     permissions:
       contents: read
       actions: read
+      id-token: write
       security-events: write
     uses: frasermolyneux/actions/.github/workflows/devops-secure-scanning.yml@main
 

.github/workflows/copilot-setup-steps.yml

@@ -11,7 +11,7 @@ on:
     paths:
       - .github/workflows/copilot-setup-steps.yml
 
-permissions: read-all
+permissions: {}
 
 jobs:
   # The job MUST be called `copilot-setup-steps` or it will not be picked up by Copilot.

.github/workflows/dependabot-automerge.yml

@@ -1,15 +1,18 @@
 name: Dependabot Auto-Merge
-on: pull_request
+on:
+  pull_request:
+    branches:
+      - main
 
-
-permissions: read-all
+permissions: {}
 
 jobs:
   dependabot:
     permissions:
       contents: write
       pull-requests: write
     runs-on: ubuntu-latest
+
     if: ${{ github.actor == 'dependabot[bot]' }}
     steps:
     - name: Dependabot metadata
@@ -18,7 +21,7 @@ jobs:
       with:
         github-token: "${{ secrets.GITHUB_TOKEN }}"
     - name: Enable auto-merge for Dependabot PRs
-      run: gh pr merge --auto --merge "$PR_URL"
+      run: gh pr merge --auto --squash "$PR_URL"
       env:
         PR_URL: ${{github.event.pull_request.html_url}}
         GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

.github/workflows/deploy-dev.yml

@@ -3,8 +3,7 @@ name: Deploy Dev
 on:
   workflow_dispatch:
 
-
-permissions: read-all
+permissions: {}
 
 jobs:
   build-and-test:

.github/workflows/deploy-prd.yml

@@ -8,8 +8,7 @@ on:
     branches:
       - main
 
-
-permissions: read-all
+permissions: {}
 
 jobs:
   build-and-test:

.github/workflows/destroy-development.yml

@@ -5,8 +5,7 @@ on:
   #schedule:
   #  - cron: "40 0 * * *"
 
-
-permissions: read-all
+permissions: {}
 
 jobs:
   terraform-destroy-dev:

.github/workflows/destroy-environment.yml

@@ -12,8 +12,7 @@ on:
           - dev
           - prd
 
-  
-permissions: read-all
+permissions: {}
 
 jobs:
   terraform-destroy:

.github/workflows/pr-verify.yml

@@ -13,8 +13,7 @@ on:
       - main
     types: [opened, synchronize, reopened, ready_for_review]
 
-
-permissions: read-all
+permissions: {}
 
 jobs:
   build-and-test:

README.md

@@ -1,6 +1,5 @@
 # XtremeIdiots Portal - Repository Func
 
-[![DevOps Secure Scanning](https://github.com/frasermolyneux/portal-repository-func/actions/workflows/devops-secure-scanning.yml/badge.svg)](https://github.com/frasermolyneux/portal-repository-func/actions/workflows/devops-secure-scanning.yml)
 [![Code Quality](https://github.com/frasermolyneux/portal-repository-func/actions/workflows/codequality.yml/badge.svg)](https://github.com/frasermolyneux/portal-repository-func/actions/workflows/codequality.yml)
 [![Build and Test](https://github.com/frasermolyneux/portal-repository-func/actions/workflows/build-and-test.yml/badge.svg)](https://github.com/frasermolyneux/portal-repository-func/actions/workflows/build-and-test.yml)
 [![PR Verify](https://github.com/frasermolyneux/portal-repository-func/actions/workflows/pr-verify.yml/badge.svg)](https://github.com/frasermolyneux/portal-repository-func/actions/workflows/pr-verify.yml)