Fix/token permissions id 20260911

.github/workflows/changelog.yml

@@ -14,7 +14,7 @@ permissions:
   # leaving this out makes GitHub reject the run at startup_failure with zero
   # jobs and no log — "requesting 'actions: read', but is only allowed 'actions: none'".
   actions: read
-  contents: write
+  contents: read
   pull-requests: write
 
 jobs:

.github/workflows/codeql-reusable.yml

@@ -89,6 +89,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v3

.github/workflows/hypatia-scan-reusable.yml

@@ -27,6 +27,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup Elixir for Hypatia scanner
         uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1

.github/workflows/readme-derive.yml

@@ -24,7 +24,7 @@ permissions:
   # leaving this out makes GitHub reject the run at startup_failure with zero
   # jobs and no log — "requesting 'actions: read', but is only allowed 'actions: none'".
   actions: read
-  contents: write
+  contents: read
 
 jobs:
   derive:

.github/workflows/signed-push-smoke.yml

@@ -14,7 +14,7 @@ concurrency:
   group: ${{ github.workflow }}
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   smoke:
@@ -23,6 +23,8 @@ jobs:
     # job that `uses:` a reusable workflow — it is an illegal key there and
     # GitHub refuses to parse the ENTIRE file, killing every job in it.
     timeout-minutes: 10
+    permissions:
+      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

config/rulesets/Immutable-Tags.json

@@ -0,0 +1,19 @@
+{
+  "name": "Immutable-Tags",
+  "target": "tag",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["~ALL"],
+      "exclude": []
+    }
+  },
+  "bypass_actors": [],
+  "rules": [
+    {"type": "creation"},
+    {"type": "deletion"},
+    {"type": "non_fast_forward"},
+    {"type": "update"},
+    {"type": "required_signatures"}
+  ]
+}

config/rulesets/Optimus-Branch.json

@@ -0,0 +1,44 @@
+{
+  "name": "Optimus-Branch",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["~DEFAULT_BRANCH"],
+      "exclude": []
+    }
+  },
+  "bypass_actors": [],
+  "rules": [
+    {
+      "type": "deletion"
+    },
+    {
+      "type": "non_fast_forward"
+    },
+    {
+      "type": "required_signatures"
+    },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 2,
+        "dismiss_stale_reviews_on_push": true,
+        "require_code_owner_review": true,
+        "require_last_push_approval": true,
+        "required_review_thread_resolution": true,
+        "require_extra_approval_for_unattributed_changes": true,
+        "required_reviewers": [],
+        "allowed_merge_methods": []
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": true,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": []
+      }
+    }
+  ]
+}