feat: push down permissions

.github/workflows/cd-compact-js.yaml

@@ -2,13 +2,7 @@ name: Publish - Compact.js
 env:
   MIDNIGHTCI_PACKAGES_WRITE: ${{ secrets.MIDNIGHTCI_PACKAGES_WRITE }}
 
-permissions:
-  contents: read
-  issues: read
-  id-token: write
-  packages: write
-  checks: write
-  pull-requests: write
+permissions: {}
 
 on:
   workflow_dispatch:
@@ -25,6 +19,10 @@ concurrency:
 jobs:
   ci:
     if: inputs.should_run == 'true'
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
     uses: ./.github/workflows/ci-base.yaml
     with:
       workspace: compact-js
@@ -35,6 +33,9 @@ jobs:
     needs: ci
     name: Publish Packages
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # ratchet:actions/checkout@v5
 

.github/workflows/cd-platform-js.yaml

@@ -2,14 +2,8 @@ name: Publish - Platform.js
 env:
   MIDNIGHTCI_PACKAGES_WRITE: ${{ secrets.MIDNIGHTCI_PACKAGES_WRITE }}
 
-permissions:
-  contents: read
-  issues: read
-  id-token: write
-  packages: write
-  checks: write
-  pull-requests: write
-
+permissions: {}
+
 on:
   workflow_dispatch:
   workflow_call:
@@ -25,6 +19,10 @@ concurrency:
 jobs:
   ci:
     if: inputs.should_run == 'true'
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
     uses: ./.github/workflows/ci-base.yaml
     with:
       workspace: platform-js
@@ -35,6 +33,9 @@ jobs:
     needs: ci
     name: Publish Packages
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # ratchet:actions/checkout@v5
 

.github/workflows/cd.yaml

@@ -2,39 +2,43 @@ name: CD
 env:
   MIDNIGHTCI_PACKAGES_WRITE: ${{ secrets.MIDNIGHTCI_PACKAGES_WRITE }}
 
+permissions: {}
+
 on:
   workflow_dispatch:
     inputs:
       workspace:
         type: choice
         description: The workspace to build and publish
-        options: 
+        options:
           - platform-js
           - compact-js
 
-permissions:
-  contents: read
-  issues: read
-  id-token: write
-  packages: write
-  checks: write
-  pull-requests: write
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ inputs.workspace }}
   cancel-in-progress: true
 
 jobs:
   cd-platformjs:
     name: Build and Publish Platform.js
-    with:
-      should_run: ${{ inputs.workspace == 'platform-js' }}
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
+      packages: write
     uses: ./.github/workflows/cd-platform-js.yaml
+    with:
+      should_run: "${{ inputs.workspace == 'platform-js' && 'true' || 'false' }}"
     secrets: inherit
 
   cd-compactjs:
     name: Build and Publish Compact.js
-    with:
-      should_run: ${{ inputs.workspace == 'compact-js' }}
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
+      packages: write
     uses: ./.github/workflows/cd-compact-js.yaml
-    secrets: inherit
+    with:
+      should_run: "${{ inputs.workspace == 'compact-js' && 'true' || 'false' }}"
+    secrets: inherit

.github/workflows/ci-base.yaml

@@ -2,11 +2,7 @@ name: CI - (base)
 env:
   MIDNIGHTCI_PACKAGES_WRITE: ${{ secrets.MIDNIGHTCI_PACKAGES_WRITE }}
 
-permissions:
-  contents: read
-  issues: read
-  checks: write
-  pull-requests: write
+permissions: {}
 
 on:
   workflow_dispatch:
@@ -35,6 +31,10 @@ jobs:
     name: Build, Lint and Test
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
     defaults:
       run:
         working-directory: ./${{ inputs.workspace }} # Workspace name has affinity to a folder in the root of the repo.

.github/workflows/ci-compact-js.yaml

@@ -2,13 +2,7 @@ name: CI - Compact.js
 env:
   MIDNIGHTCI_PACKAGES_WRITE: ${{ secrets.MIDNIGHTCI_PACKAGES_WRITE }}
 
-permissions:
-  contents: read
-  issues: read
-  id-token: write
-  packages: write
-  checks: write
-  pull-requests: write
+permissions: {}
 
 on:
   workflow_dispatch:
@@ -25,6 +19,10 @@ concurrency:
 jobs:
   ci:
     if: inputs.should_run == 'true'
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
     uses: ./.github/workflows/ci-base.yaml
     with:
       workspace: compact-js

.github/workflows/ci-platform-js.yaml

@@ -2,13 +2,7 @@ name: CI - Platform.js
 env:
   MIDNIGHTCI_PACKAGES_WRITE: ${{ secrets.MIDNIGHTCI_PACKAGES_WRITE }}
 
-permissions:
-  contents: read
-  issues: read
-  id-token: write
-  packages: write
-  checks: write
-  pull-requests: write
+permissions: {}
 
 on:
   workflow_dispatch:
@@ -25,10 +19,13 @@ concurrency:
 jobs:
   ci:
     if: inputs.should_run == 'true'
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
     uses: ./.github/workflows/ci-base.yaml
     with:
       workspace: platform-js
       coverage-files: |
         platform-js, ./platform-js/platform-js/coverage/coverage-summary.json
     secrets: inherit
-

.github/workflows/ci.yaml

@@ -2,6 +2,8 @@ name: CI
 env:
   MIDNIGHTCI_PACKAGES_WRITE: ${{ secrets.MIDNIGHTCI_PACKAGES_WRITE }}
 
+permissions: {}
+
 on:
   push:
     branches:
@@ -11,21 +13,15 @@ on:
   schedule:
     - cron: "30 4 * * *"
 
-permissions:
-  contents: read
-  issues: read
-  id-token: write
-  packages: write
-  checks: write
-  pull-requests: write
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:
   ci:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       build_c_js: ${{ steps.build-targets.outputs.compact-js }}
       build_p_js: ${{ steps.build-targets.outputs.platform-js }}
@@ -48,6 +44,10 @@ jobs:
   ci-platformjs:
     needs: ci
     name: Build, Lint and Test Platform.js
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
     with:
       should_run: ${{ needs.ci.outputs.build_p_js }}
     uses: ./.github/workflows/ci-platform-js.yaml
@@ -56,6 +56,10 @@ jobs:
   ci-compactjs:
     needs: ci
     name: Build, Lint and Test Compact.js
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
     with:
       should_run: ${{ needs.ci.outputs.build_c_js }}
     uses: ./.github/workflows/ci-compact-js.yaml