Fix/token permissions id 20260911

.github/dependabot.yml

@@ -9,6 +9,7 @@ updates:
       actions:
         patterns:
           - "*"
+    open-pull-requests-limit: 2
 
   # Rust dependencies. Keep every Cargo project in one update entry so the
   # open-PR limit applies to the fleet as a whole, rather than once per bot.

.github/workflows/codeql.yml

@@ -44,15 +44,17 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.37.8
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.37.8
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v3
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/governance.yml

@@ -34,4 +34,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd # main 2026-06-27
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@8f31a5a4ba591d544b65f91f6d78b136e07756f0 # main 2026-06-27

.github/workflows/hypatia-scan.yml

@@ -30,7 +30,7 @@ permissions:
 
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@cc58c0cb23f73fc2019ce85a56a468e5248a93b3
     secrets: inherit
     # Total caller-side wall-clock cap for the reusable. Matches
     # Hypatia's `missing_timeout_minutes` rule expectation. The scan is

.github/workflows/inbox-steward.yml

@@ -47,8 +47,8 @@ on:
   # MONITORING; the auto-merge job itself is gated OFF by default (see below).
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
+  pull-requests: read
   repository-projects: read
   actions: read
 
@@ -282,6 +282,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     needs: validate-prs
+    permissions:
+      contents: write
+      pull-requests: write
     # NEUTERED 2026-06-16 (owner directive: security/dep PRs are manual-review only).
     # Auto-merge is gated behind an explicit, default-OFF opt-in. Until the repo
     # variable INBOX_STEWARD_AUTOMERGE is set to 'true', this job NEVER runs and
@@ -376,7 +379,8 @@ jobs:
     timeout-minutes: 5
     needs: [identify-passed-prs, validate-prs, auto-merge-prs]
     if: always() && (needs.identify-passed-prs.result == 'success' || needs.validate-prs.result == 'success')
-
+    permissions:
+      contents: write
     steps:
       - name: Checkout gitbot-fleet
         uses: actions/checkout@v7.0.1

.github/workflows/scorecard.yml

@@ -15,5 +15,5 @@ jobs:
     permissions:
       security-events: write
       id-token: write
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@8750b94ac1bbe8c51ad13fe106669b13478f0b62
     secrets: inherit

robot-repo-automaton/.github/dependabot.yml

@@ -8,6 +8,7 @@ updates:
       actions:
         patterns:
           - "*"
+    open-pull-requests-limit: 2
 
   - package-ecosystem: "cargo"
     directory: "/"
@@ -16,13 +17,16 @@ updates:
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-patch"]
+    open-pull-requests-limit: 0
 
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "daily"
+    open-pull-requests-limit: 3
 
   - package-ecosystem: "pip"
     directory: "/"
     schedule:
       interval: "daily"
+    open-pull-requests-limit: 3