feat(ci): least-privilege token permissions; fix 2 workflow bugs

.github/workflows/add-from-issue.yml

@@ -5,14 +5,16 @@ on:
     types: [opened, edited, labeled]
 
 permissions:
-  contents: write
-  issues: write
-  pull-requests: write
+  contents: read
 
 jobs:
   parse-and-pr:
     if: contains(github.event.issue.labels.*.name, 'add-repo')
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
     steps:
       # pin: v6.0.0 -- actions/checkout
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3

.github/workflows/auto-merge-dependabot.yml

@@ -24,7 +24,6 @@ on:
 
 permissions:
   contents: read
-  pull-requests: write
 
 concurrency:
   group: auto-merge-dependabot-${{ github.event.pull_request.number }}
@@ -36,6 +35,9 @@ jobs:
     runs-on: ubuntu-latest
     if: github.actor == 'dependabot[bot]'
     timeout-minutes: 20
+    permissions:
+      contents: read
+      pull-requests: write
 
     steps:
       - name: Fetch Dependabot metadata

.github/workflows/auto-merge-release-please.yml

@@ -30,7 +30,6 @@ on:
 
 permissions:
   contents: read
-  pull-requests: write
 
 concurrency:
   group: auto-merge-release-please-${{ github.event.pull_request.number }}
@@ -40,6 +39,9 @@ jobs:
   auto-merge:
     name: Auto-merge release-please PR
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     # Author filter is the load-bearing safety check. release-please runs as
     # `release-please[bot]` on the GitHub App, or as `github-actions[bot]`
     # when triggered via workflow_dispatch through the action. We accept

.github/workflows/auto-merge.yml

@@ -5,13 +5,15 @@ on:
     types: [opened, synchronize, reopened]
 
 permissions:
-  pull-requests: write
-  contents: write
-  checks: read
+  contents: read
 
 jobs:
   auto-merge:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+      checks: read
     steps:
       # pin: v6.0.0 -- actions/checkout
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3

.github/workflows/docs-on-release.yml

@@ -6,7 +6,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
+  contents: read
 
 concurrency:
   group: docs-on-release
@@ -15,6 +15,9 @@ concurrency:
 jobs:
   update-docs:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      actions: write
     steps:
       # pin: v6.0.0 -- actions/checkout
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3

.github/workflows/first-interaction.yml

@@ -11,25 +11,27 @@ on:
     types: [opened]
 
 permissions:
-  issues: write
-  pull-requests: write
+  contents: read
 
 jobs:
   greet:
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
       - uses: actions/first-interaction@1c4688942c71f71d4f5502a26ea67c331730fa4d # pin: v3.1.0
         with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-          pr-message: >
+          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          pr_message: >
             Thanks for your first PR to understand-quickly! A maintainer will
             review shortly. If this adds a new entry to `registry.json`, the
             validate workflow will fetch your graph_url + check schema; if it
             adds a new graph format, `CONTRIBUTING.md` walks through the schema
             authoring flow. Questions:
             [Discussions](https://github.com/looptech-ai/understand-quickly/discussions).
-          issue-message: >
+          issue_message: >
             Thanks for opening your first issue! For "add my repo" requests,
             the [wizard](https://looptech-ai.github.io/understand-quickly/add.html)
             is often faster. For protocol questions, see

.github/workflows/labeler.yml

@@ -11,12 +11,14 @@ on:
 
 permissions:
   contents: read
-  pull-requests: write
 
 jobs:
   label:
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # pin: v5.0.0
         with:

.github/workflows/lychee.yml

@@ -20,13 +20,15 @@ on:
 
 permissions:
   contents: read
-  issues: write
 
 jobs:
   link-check:
     name: lychee
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    permissions:
+      contents: read
+      issues: write
     steps:
       - name: Checkout
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # pin: v5.0.0

.github/workflows/outdated-watch.yml

@@ -16,7 +16,6 @@ on:
 
 permissions:
   contents: read
-  issues: write
 
 concurrency:
   group: outdated-watch
@@ -27,6 +26,9 @@ jobs:
     name: Scan + post outdated summary
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    permissions:
+      contents: read
+      issues: write
     steps:
       # pin: v6.0.0 -- actions/checkout
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3

.github/workflows/pages.yml

@@ -14,8 +14,6 @@ on:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 concurrency:
   group: pages
@@ -24,6 +22,8 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       # pin: v6.0.0 -- actions/checkout
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
@@ -93,6 +93,10 @@ jobs:
   deploy:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deploy.outputs.page_url }}

.github/workflows/release-please.yml

@@ -11,12 +11,14 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       # pin: v4.1.5 -- googleapis/release-please-action
       - uses: googleapis/release-please-action@5792afc6b46e9bb55deda9eda973a18c226bc3fc

.github/workflows/render.yml

@@ -6,12 +6,14 @@ on:
     paths: ['registry.json']
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   render:
     if: github.actor != 'github-actions[bot]' || !startsWith(github.event.head_commit.message, 'docs(readme):')
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       # pin: v6.0.0 -- actions/checkout
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3

.github/workflows/scorecard.yml

@@ -16,7 +16,8 @@ on:
     branches: [main]
   workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   analysis:

.github/workflows/semantic-pr.yml

@@ -16,13 +16,16 @@ on:
       - synchronize
 
 permissions:
-  pull-requests: read
+  contents: read
 
 jobs:
   validate:
     name: Validate PR title
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: read
     steps:
       - uses: amannn/action-semantic-pull-request@e32d7e603df1aa1ba07e981f2a23455dee596825 # pin: v5.5.3
         env:

.github/workflows/stale.yml

@@ -17,13 +17,15 @@ on:
 
 permissions:
   contents: read
-  issues: write
-  pull-requests: write
 
 jobs:
   stale:
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
     steps:
       - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # pin: v9.1.0
         with:

.github/workflows/sync.yml

@@ -18,8 +18,7 @@ on:
         default: false
 
 permissions:
-  contents: write
-  actions: write
+  contents: read
 
 concurrency:
   group: sync-${{ github.event.client_payload.id || github.event.inputs.id || 'all' }}
@@ -28,6 +27,9 @@ concurrency:
 jobs:
   sync:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      actions: write
     steps:
       # pin: v6.0.0 -- actions/checkout
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3