otp: add comments and explicit permissions

Author: kikofernandez

.github/workflows/main.yaml

@@ -56,7 +56,6 @@ env:
 permissions:
   contents: read
   pull-requests: read
-  security-events: read
 
 jobs:
 

.github/workflows/openvex-sync.yml

@@ -35,10 +35,10 @@ jobs:
   run-scheduled-openvex-sync:
     runs-on: ubuntu-latest
     permissions:
-      security-events: read
-      actions: write
-      contents: write
-      pull-requests: write
+      security-events: read # use inside the otp-compliance.es as API call
+      actions: write        # use inside the otp-compliance.es
+      contents: write       # use inside the otp-compliance.es
+      pull-requests: write  # use inside the otp-compliance.es
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:

.github/workflows/osv-scanner-scheduled.yml

@@ -34,6 +34,8 @@ permissions:
 jobs:
   schedule-scan:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     if: github.event_name == 'schedule' && github.repository == 'erlang/otp'
     # if: github.event_name != 'workflow_dispatch' # used for testing
     outputs:

.github/workflows/renovate-vendored-deps.yaml

@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write   # Required to push commits
-      pull-requests: read
+      pull-requests: write
     if: >
       github.event_name == 'pull_request' &&
       contains(github.event.pull_request.title, 'update dependency') &&

.github/workflows/scorecard.yaml

@@ -29,7 +29,9 @@ on:
     branches:
       - master
 
-permissions: read-all
+permissions:
+  contents: read
+  actions: read
 
 jobs:
   analysis: