ci: least-privilege permissions on spellcheck (read) and stale-issues (job-level write for actions/stale) (#4080)

* ci: declare workflow-level contents: read on spellcheck and stale-issues

Workflow runs checks only; no GitHub API writes. Post-CVE-2025-30066 hardening pattern.

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>

* Grant stale job issues: write + pull-requests: write

The previous workflow-level contents: read default broke
actions/stale, which needs issues: write and pull-requests: write to
mark and close stale issues/PRs (caught by cursor[bot] review).

Adding the writes at the job level instead of the workflow level keeps
spellcheck and any future job on least-privilege contents: read.

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>

* ci(stale-issues): add actions: write for actions/stale cache

actions/stale@v10 persists its run state in the Actions cache, which needs
actions: write at the job level in addition to issues/pull-requests write.
This matches the recommended permissions block in the action's README.

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>

* Set workflow-level permissions to empty in stale-issues workflow

The stale job declares its own permissions block, so the workflow-level
contents: read had no effect on its token. This workflow does not read
repository contents, so an empty permissions block is the clearest
least-privilege default at the workflow level.

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>

---------

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
Co-authored-by: petyaslavova <petya.slavova@redis.com>

Author: arpitjain099

.github/workflows/spellcheck.yml

@@ -1,6 +1,9 @@
 name: spellcheck
 on:
   pull_request:
+permissions:
+  contents: read
+
 jobs:
   check-spelling:
     runs-on: ubuntu-latest

.github/workflows/stale-issues.yml

@@ -14,9 +14,15 @@ env:
   NEEDS_INFO_DAYS_BEFORE_STALE: 30
   NEEDS_INFO_DAYS_BEFORE_CLOSE: 7
 
+permissions: {}
+
 jobs:
   stale:
     runs-on: ubuntu-latest
+    permissions:
+      issues: write          # required by actions/stale to label/close issues
+      pull-requests: write   # required by actions/stale to label/close PRs
+      actions: write         # required by actions/stale@v10 for its cache state
     steps:
       # First step: Handle regular issues (excluding needs-information)
       - name: Mark regular issues as stale