ci: harden workflow token permissions and add CodeQL analysis

Declare a read-only top-level permissions block in every workflow and
move write scopes to the jobs that use them, add a CodeQL workflow, and
replace the unpinned npm install in the PR label check with npm ci.

- release.yml: top-level actions/checks/contents/id-token/issues/
  pull-requests/packages write replaced by contents: read; each job now
  declares only the scopes its steps use (dispatch-rc: actions+contents
  write; create-github-release: contents/issues/pull-requests write;
  create-snapshot-pr: contents/pull-requests write; publish-npm-package:
  id-token/packages write)
- tests.yml, manual-testing.yml: checks: write and pull-requests: write
  moved from the top level to each job calling test-workflow.yml and to
  PublishResults; effective job permissions are unchanged
- pr-label-milestone-check.yml: add the missing permissions block
  (contents: read top level, issues/pull-requests read on the job) and
  use npm ci --omit=dev instead of npm install axios
- add .github/workflows/codeql.yml (actions + javascript-typescript,
  build-mode none) on pull_request, push to main/release/** and weekly

Scorecard checks affected: Token-Permissions (0 -> 10), SAST (0 -> 10
locally), Pinned-Dependencies (8 -> 9).

Signed-off-by: Michael Garber <michael.garber@hashgraph.com>

Author: mgarbs

.github/workflows/codeql.yml

@@ -0,0 +1,58 @@
+name: CodeQL
+
+on:
+  pull_request:
+    branches:
+      - main
+      - release/**
+  push:
+    branches:
+      - main
+      - release/**
+  schedule:
+    - cron: '17 3 * * 1'
+
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: hl-contr-lin-md
+    permissions:
+      contents: read
+      actions: read
+      packages: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            build-mode: none
+          - language: javascript-typescript
+            build-mode: none
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        with:
+          category: '/language:${{ matrix.language }}'

.github/workflows/manual-testing.yml

@@ -18,8 +18,6 @@ run-name: Manual Test with N:${{ inputs.networkNodeTag }}, M:${{ inputs.mirrorNo
 
 permissions:
   contents: read
-  checks: write
-  pull-requests: write
 
 defaults:
   run:
@@ -29,6 +27,10 @@ jobs:
   ERC20Contract:
     name: ERC20 Contract Test Suite
     uses: ./.github/workflows/test-workflow.yml
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
     with:
       testfilter: ERC20
       networkTag: ${{inputs.networkNodeTag}}
@@ -38,6 +40,10 @@ jobs:
   ERC721Contract:
     name: ERC721 Contract Test Suite
     uses: ./.github/workflows/test-workflow.yml
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
     with:
       testfilter: ERC721
       networkTag: ${{inputs.networkNodeTag}}
@@ -47,6 +53,10 @@ jobs:
   ERC1155Contract:
     name: ERC1155 Contract Test Suite
     uses: ./.github/workflows/test-workflow.yml
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
     with:
       testfilter: ERC1155
       networkTag: ${{inputs.networkNodeTag}}
@@ -56,6 +66,10 @@ jobs:
   TokenCreateContract:
     name: Token Create Test Suite
     uses: ./.github/workflows/test-workflow.yml
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
     with:
       testfilter: TokenCreateContract
       networkTag: ${{inputs.networkNodeTag}}
@@ -65,6 +79,10 @@ jobs:
   TokenQueryContract:
     name: Token Query Test Suite
     uses: ./.github/workflows/test-workflow.yml
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
     with:
       testfilter: TokenQueryContract
       networkTag: ${{inputs.networkNodeTag}}
@@ -74,6 +92,10 @@ jobs:
   TokenManagmentContract:
     name: Token Managment Test Suite
     uses: ./.github/workflows/test-workflow.yml
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
     with:
       testfilter: TokenManagmentContract
       networkTag: ${{inputs.networkNodeTag}}
@@ -83,6 +105,10 @@ jobs:
   TokenTransferContract:
     name: Token Transfer Test Suite
     uses: ./.github/workflows/test-workflow.yml
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
     with:
       testfilter: TokenTransferContract
       networkTag: ${{inputs.networkNodeTag}}
@@ -92,6 +118,10 @@ jobs:
   HIP583:
     name: HIP583 Test Suite
     uses: ./.github/workflows/test-workflow.yml
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
     with:
       testfilter: HIP583
       networkTag: ${{inputs.networkNodeTag}}
@@ -101,6 +131,10 @@ jobs:
   HRC:
     name: HRC Test Suite
     uses: ./.github/workflows/test-workflow.yml
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
     with:
       testfilter: HRC
       networkTag: ${{inputs.networkNodeTag}}
@@ -110,6 +144,10 @@ jobs:
   PrngSystemContract:
     name: PrngSystemContract Test Suite
     uses: ./.github/workflows/test-workflow.yml
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
     with:
       testfilter: PrngSystemContract
       networkTag: ${{inputs.networkNodeTag}}
@@ -119,6 +157,10 @@ jobs:
   HIP904Batch1:
     name: HIP904 Contract Test Suite Batch 1
     uses: ./.github/workflows/test-workflow.yml
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
     with:
       testfilter: 'HIP904Batch1'
       networkTag: ${{inputs.networkNodeTag}}
@@ -128,6 +170,10 @@ jobs:
   HIP904Batch2:
     name: HIP904 Contract Test Suite Batch 2
     uses: ./.github/workflows/test-workflow.yml
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
     with:
       testfilter: 'HIP904Batch2'
       networkTag: ${{inputs.networkNodeTag}}
@@ -137,6 +183,10 @@ jobs:
   HIP904Batch3:
     name: HIP904 Contract Test Suite Batch 3
     uses: ./.github/workflows/test-workflow.yml
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
     with:
       testfilter: 'HIP904Batch3'
       networkTag: ${{inputs.networkNodeTag}}
@@ -146,6 +196,10 @@ jobs:
   HIP1215:
     name: HIP1215 Test Suite
     uses: ./.github/workflows/test-workflow.yml
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
     with:
       testfilter: HIP1215
       networkTag: ${{inputs.networkNodeTag}}

.github/workflows/pr-label-milestone-check.yml

@@ -4,9 +4,16 @@ on:
   pull_request:
     types: [opened, edited, labeled, unlabeled, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   check_pr:
     runs-on: hl-contr-lin-md
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
 
     steps:
       - name: Harden Runner
@@ -23,7 +30,7 @@ jobs:
           node-version: '20'
 
       - name: Install dependencies
-        run: npm install axios
+        run: npm ci --omit=dev
 
       - name: Check PR labels and milestones
         env:

.github/workflows/release.yml

@@ -26,13 +26,7 @@ env:
   RELEASE_TYPE: ${{ inputs.release-type }}
 
 permissions:
-  actions: write
-  checks: write
-  contents: write
-  id-token: write
-  issues: write
-  pull-requests: write
-  packages: write
+  contents: read
 
 jobs:
   # ─────────────────────────────────────────────────────────────────────────────
@@ -43,6 +37,9 @@ jobs:
     name: Release / Dispatch RC
     if: ${{ inputs.release-type == 'rc' && github.ref_name == github.event.repository.default_branch }}
     runs-on: hl-contr-lin-lg
+    permissions:
+      actions: write
+      contents: write
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
@@ -91,6 +88,8 @@ jobs:
     name: Release / Prepare
     if: ${{ (inputs.release-type == 'standard' && github.ref_name == github.event.repository.default_branch) || (inputs.release-type == 'rc' && startsWith(github.ref_name, 'rc/')) }}
     runs-on: hl-contr-lin-lg
+    permissions:
+      contents: read
     outputs:
       version: ${{ steps.set-outputs.outputs.version }}
       need-release: ${{ steps.set-outputs.outputs.need-release }}
@@ -227,6 +226,10 @@ jobs:
     name: Release / Github
     if: ${{ needs.prepare-release.outputs.need-release == 'true' }}
     runs-on: hl-contr-lin-lg
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
     needs:
       - prepare-release
     outputs:
@@ -355,6 +358,9 @@ jobs:
   create-snapshot-pr:
     name: Release / Snapshot
     runs-on: hl-contr-lin-lg
+    permissions:
+      contents: write
+      pull-requests: write
     needs:
       - prepare-release
       - create-github-release
@@ -439,6 +445,10 @@ jobs:
     name: Release / Publish Hiero Contracts NPM package
     if: ${{ needs.prepare-release.outputs.need-release == 'true' && !inputs.dry-run-enabled }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
     needs:
       - prepare-release
       - create-github-release