Audit and tighten GITHUB_TOKEN permissions on CI workflows

[kriszyp]

The repository default for GITHUB_TOKEN is default_workflow_permissions: write and can_approve_pull_request_reviews: true. The majority of workflows do not declare an explicit permissions: block, so they inherit broad write access (and PR-approve) regardless of what they actually need.

Workflows currently lacking explicit permissions:

• claude-issue-to-pr.yml, claude-mention.yml, claude-review.yml
• validate-caller-workflows.yml
• create-release.yaml
• integration-tests.yaml
• lint-code.yaml
• notify-release-published.yaml
• publish-docker.yaml
• publish-npm.yaml

Workflows that already scope permissions: cherry-pick-patch.yml, sync-core.yaml, report-cherry-pick-tests.yml.

Same gap exists in HarperFast/harper-pro (workflows mirror via sync-core).

Asks

• Set top-level permissions: on every workflow with the minimum scopes it needs. Recommend default-deny (permissions: {} at the workflow level, then job-level grants where needed).
• Consider flipping repo defaults to default_workflow_permissions: read (and disabling can_approve_pull_request_reviews) once all workflows declare what they need.
• Document the convention so future workflows opt-in to required scopes.

Acceptance criteria

• Every workflow file declares an explicit permissions: block.
• CI passes after the tightening (workflows that need contents: write, pull-requests: write, packages: write, etc. continue to function).
• Repo-level default flipped to read once individual workflow scopes are in place.

Notes for reviewer

• Release workflows (create-release.yaml, publish-npm.yaml, publish-docker.yaml) need write on contents / packages.
• Claude workflows (claude-issue-to-pr.yml, claude-mention.yml, claude-review.yml) need pull-requests: write, issues: write, and contents: write for branch pushes.
• Test/lint workflows likely need only contents: read.

---

Tracked in Jira: CORE-3054

🤖 Filed by Claude on behalf of Kris.