Restrict GitHub Actions workflow permissions

[dannyhw]

Summary

• restrict the CI and main-matrix workflows to read-only repository contents
• grant the stale workflow only the write permissions required to manage repository contents, issues, and pull requests
• address the five open actions/missing-workflow-permissions CodeQL alerts: #5, #6, #8, #9, and #18

Root cause

These workflows did not declare explicit GITHUB_TOKEN permissions, so their effective access depended on repository or organization defaults.

Impact

The test workflows now operate with read-only access. The stale bot retains the minimum write access needed to label, update, and close stale issues and pull requests. No application or package behavior changes.

Validation

• actionlint .github/workflows/test-main-matrix.yml .github/workflows/test.yml .github/workflows/stale-bot.yml
• parsed all three files as YAML
• git diff --check

[changeset-bot]

⚠️ No Changeset found

Latest commit: 72eee33

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
repack-website	Ready	Preview, Comment	Jul 27, 2026 9:53pm