chore(OSSF): update token permissions to improve ossf scorecard

.github/workflows/ci.yml

@@ -10,7 +10,10 @@ on:
     branches: [ main ]
 
 permissions:
+  contents: read
   pull-requests: write
+  actions: read
+  statuses: write
 
 jobs:
   build:
@@ -78,5 +81,3 @@ jobs:
         wait-on: "http://localhost:3000"
         wait-on-timeout: 120
         run: npm run cypress:run
-
-

.github/workflows/codeql.yml

@@ -19,6 +19,12 @@ on:
   schedule:
     - cron: '25 10 * * 1'
 
+permissions:
+  security-events: write
+  contents: read
+  actions: read
+  statuses: write
+
 jobs:
   analyze:
     name: Analyze

.github/workflows/dependency-review.yml

@@ -8,6 +8,10 @@ permissions:
 jobs:
   dependency-review:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+
     steps:
       - name: 'Checkout Repository'
         uses: actions/checkout@v4

.github/workflows/lint.yml

@@ -2,6 +2,11 @@ name: Code Cleanliness
 
 on: [pull_request]
 
+permissions:
+  contents: read
+  pull-requests: none
+  actions: read
+
 env: # environment variables (available in any part of the action)
   NODE_VERSION: 18
 
@@ -26,4 +31,4 @@ jobs:
       - name: Code Linting
         run: |
           npm run lint
-          npm run lint --workspaces --if-present
+          npm run lint --workspaces --if-present

.github/workflows/npm.yml

@@ -2,6 +2,11 @@ name: Publish to NPM
 on:
   release:
     types: [published]
+
+permissions:
+  contents: read
+  actions: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/scorecard.yml

@@ -14,8 +14,10 @@ on:
   push:
     branches: [ "main" ]
 
-# Declare default permissions as read only.
-permissions: read-all
+permissions:
+  contents: read
+  security-events: write
+  id-token: write
 
 jobs:
   analysis: