fix(ci): workflows start with no token permissions and the Maven wrapper ships no jar (#1736)

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

Author: FelixTJDietrich

.changeset/wrapper-ships-no-jar.md

@@ -0,0 +1,4 @@
+---
+---
+
+No release note: the Maven wrapper now downloads Maven through its script alone, so the repository ships no binary; the checksum check and the Maven version are unchanged.

.github/workflows/ci-profile.yml

@@ -9,6 +9,8 @@ concurrency:
   group: ci-profile-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   server-integration:
     name: "Server integration profile"

.github/workflows/ci-quality-gates.yml

@@ -34,6 +34,8 @@ on:
       SURGE_TOKEN:
         required: false
 
+permissions: {}
+
 jobs:
   quality-gates:
     name: "${{ matrix.display-name }}"

.github/workflows/ci-security-scan.yml

@@ -9,6 +9,8 @@ on:
         type: string
         default: "false"
 
+permissions: {}
+
 jobs:
   dependency-review:
     name: "New dependency risk"

.github/workflows/deploy-locked-compose.yml

@@ -21,6 +21,8 @@ on:
         required: false
         default: ""
 
+permissions: {}
+
 jobs:
   deploy:
     timeout-minutes: 20

.github/workflows/pull-request.yml

@@ -14,6 +14,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   validate-title:
     name: "Validate title"

.github/workflows/reusable-docker-build.yml

@@ -65,6 +65,8 @@ on:
         description: "Published image digest; an index digest for multi-architecture builds."
         value: ${{ inputs.single-arch && jobs.build.outputs.manifest-digest || jobs.merge.outputs.manifest-digest }}
 
+permissions: {}
+
 env:
   STANDARD_IMAGE_TAGS: |
     ${{ github.event_name == 'push' && github.ref_name || '' }}

docs/contributor/local-development.mdx

@@ -11,7 +11,10 @@ Hephaestus supports full-stack development across Java and TypeScript. This guid
 
 Install and configure the following tools before you attempt a local build:
 
-1. **Java JDK 21** – Required for the Spring Boot application server.
+1. **Java JDK 21**, plus `curl` or `wget` and `unzip` – Required for the Spring Boot application
+   server. The Maven wrapper ships no binary: on first use it downloads Maven and verifies the
+   archive against the checksum in `server/.mvn/wrapper/maven-wrapper.properties`, and without
+   `unzip` it falls back to an archive that checksum does not cover and refuses it.
 2. **Docker and Docker Compose** – Required for PostgreSQL and NATS. Verify both with `docker info`
    and `docker compose version`.
 3. **Node.js** – Match `package.json#devEngines.runtime`; it executes repository scripts and

server/.mvn/wrapper/maven-wrapper.jar

@@ -1,6 +1,6 @@
+# mvnw checks distributionSha256Sum before it unpacks a download. `wrapper:wrapper` regenerates
+# the scripts without it, so keep the line when you change the Maven version by hand.
 wrapperVersion=3.3.4
-distributionType=bin
-wrapperSha256Sum=4e2fbf6554bc8a4702cdfdd3bef464f423393d784ddbb037216320ce55d5e4e1
+distributionType=only-script
 distributionSha256Sum=5af3b743dd8b876b5c45da33b676251e5f1687712644abb4ee519ca56e1d89ce
 distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.16/apache-maven-3.9.16-bin.zip
-wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.4/maven-wrapper-3.3.4.jar