chore(vuln): scope workflow permissions to least privilege (SEC-167) (#195)

Author: aris1009

.github/workflows/housekeeping.yaml

@@ -4,6 +4,9 @@ on:
   schedule:
     - cron: '42 1 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   prs:
     name: Clean up stale prs
@@ -39,6 +42,8 @@ jobs:
   branches:
       name: Cleanup old branches
       runs-on: ubuntu-latest
+      permissions:
+        contents: write
       steps:
         - name: Harden the runner (Audit all outbound calls)
           uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0

.github/workflows/pr-description-enforcer.yaml

@@ -6,9 +6,15 @@ on:
       - edited
       - reopened
 
+permissions:
+  contents: read
+
 jobs:
   enforce:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
 
     steps:
       - name: Harden the runner (Audit all outbound calls)

.github/workflows/tests.yaml

@@ -9,6 +9,10 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.sha }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   unit:
     name: Unit