Scope dependabot-repair workflow token permissions to least privilege

[Copilot]

The static-analysis report was flat overall, with one actionable non-FP signal: zizmor excessive-permissions on dependabot-repair.lock.yml (agent job). This change narrows default workflow permissions so the compiled job no longer inherits broad token scope.

• Problem focus

  • Address the single medium-severity excessive-permissions finding in dependabot-repair while leaving accepted FP clusters unchanged.

• Workflow source change (.github/workflows/dependabot-repair.md)

  • Replaced top-level permissions: read-all with explicit read-only scopes:
    • actions: read
    • contents: read
    • issues: read
    • pull-requests: read

• Generated workflow impact (.github/workflows/dependabot-repair.lock.yml)

  • Recompiled output now reflects scoped read permissions on the agent job instead of read-all.
  • Existing write scopes on downstream safe_outputs/conclusion jobs remain explicit and unchanged.

# before
permissions: read-all

# after
permissions:
  actions: read
  contents: read
  issues: read
  pull-requests: read

[github-actions]

🤖 PR Triage — Run §28715668077

Field	Value
Category	chore
Risk	🟢 Low
Score	70/100
Impact	35/50 — scopes dependabot-repair token to least privilege (security hardening)
Urgency	25/30 — security improvement; +6/-2 YAML, 2 files
Quality	10/20 — draft, no CI yet
Action	🚀 fast_track
Batch	pr-batch:new-workflows

Minimal low-risk YAML change adding correct token permission scopes. Recommend undraft → fast-track.

Generated by 🔧 PR Triage Agent · 113.5 AIC · ⌖ 13 AIC · ⊞ 5.5K · ◷