feat: lockdown permissions

.github/workflows/ci.yml

@@ -7,6 +7,8 @@ on:
 concurrency:
   group: ${{ github.ref }}-${{ github.workflow }}
   cancel-in-progress: true
+permissions:
+  contents: read
 jobs:
   test:
     strategy:

.github/workflows/mega-linter.yml

@@ -7,14 +7,13 @@ on:
 concurrency:
   group: ${{ github.ref }}-${{ github.workflow }}
   cancel-in-progress: true
+permissions:
+  contents: read
+  pull-requests: write
 jobs:
   megalinter:
     name: MegaLinter
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      issues: write
-      pull-requests: write
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4
@@ -33,11 +32,3 @@ jobs:
         env:
           VALIDATE_ALL_CODEBASE: false
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Archive production artifacts
-        uses: actions/upload-artifact@v4
-        if: success() || failure()
-        with:
-          name: MegaLinter reports
-          path: |
-            megalinter-reports
-            mega-linter.log

.github/workflows/publish.yml

@@ -6,14 +6,14 @@ on:
       - main
 env:
   HUSKY: 0
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
 jobs:
   publish:
     name: Publish
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      issues: write
-      pull-requests: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4