fix(ci): scope tokens

Author: bleggett

.github/workflows/digestabot.yml

@@ -35,6 +35,10 @@ jobs:
       with:
         app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}"
         private-key: "${{ secrets.EDERA_CULTIVATION_APP_PRIVATE_KEY }}"
+        # Scope to what digestabot needs: push the update branch (contents)
+        # and open the PR (pull-requests).
+        permission-contents: write
+        permission-pull-requests: write
 
     - uses: chainguard-dev/digestabot@33d0b78e580aa0c83fe188eb3dfad6611b662479 # a110b65f3d4742d56b5b2b2306de6e2e54306724
       with:

.github/workflows/markdown-lint.yml

@@ -32,6 +32,9 @@ jobs:
         with:
           app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}"
           private-key: "${{ secrets.EDERA_CULTIVATION_APP_PRIVATE_KEY }}"
+          # Scope to only what reviewdog's github-pr-review reporter needs:
+          # posting review comments on the PR.
+          permission-pull-requests: write
 
       - name: markdownlint
         uses: step-security/action-markdownlint@7eff996c965b6b4a8575f7971d970fc40479c321

.github/workflows/release-artifacts.yml

@@ -183,6 +183,8 @@ jobs:
         with:
           app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}"
           private-key: "${{ secrets.EDERA_CULTIVATION_APP_PRIVATE_KEY }}"
+          # Scope to what `gh release upload` needs: write release assets.
+          permission-contents: write
 
       - name: 'Upload release artifacts with retry'
         uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0

.github/workflows/release.yaml

@@ -40,6 +40,9 @@ jobs:
         with:
           app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}"
           private-key: "${{ secrets.EDERA_CULTIVATION_APP_PRIVATE_KEY }}"
+          # Scope to what release-plz's `release` command needs: create tags
+          # and GitHub releases.
+          permission-contents: write
 
       - name: Run release-plz
         uses: release-plz/action@e8792575c7f2366cf6ff3ccc33ead9ace5b691c7 # v0.5
@@ -81,6 +84,10 @@ jobs:
         with:
           app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}"
           private-key: "${{ secrets.EDERA_CULTIVATION_APP_PRIVATE_KEY }}"
+          # Scope to what release-plz's `release-pr` command needs: push the
+          # release branch (contents) and open/update the PR (pull-requests).
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Run release-plz
         uses: release-plz/action@e8792575c7f2366cf6ff3ccc33ead9ace5b691c7 # v0.5