Lock down GitHub workflows

.changeset/lazy-ants-brush.md

@@ -0,0 +1,7 @@
+---
+"skuba": patch
+---
+
+template/oss-npm-package: Lock down GitHub workflow permissions
+
+This aligns with [OpenSSF guidance](https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions).

.github/workflows/codeql-analysis.yml

@@ -6,14 +6,19 @@
 name: CodeQL
 
 on:
-  push:
   pull_request:
+  push:
   schedule:
     - cron: '0 22 * * 0'
 
+permissions: {}
+
 jobs:
   analyze:
     name: Analyze
+    permissions:
+      actions: read
+      security-events: write
     runs-on: ubuntu-latest
 
     strategy:

.github/workflows/release.yml

@@ -6,6 +6,8 @@ on:
       - beta
       - master
 
+permissions: {}
+
 jobs:
   release:
     name: Publish & Deploy

.github/workflows/validate.yml

@@ -15,9 +15,13 @@ on:
     workflows:
       - Release
 
+permissions: {}
+
 jobs:
   core:
     name: Lint & Test
+    permissions:
+      checks: write
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo

template/oss-npm-package/.github/workflows/release.yml

@@ -6,9 +6,13 @@ on:
       - beta
       - master
 
+permissions: {}
+
 jobs:
   release:
     name: Publish & Deploy
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo

template/oss-npm-package/.github/workflows/validate.yml

@@ -4,9 +4,13 @@ on:
   - pull_request
   - push
 
+permissions: {}
+
 jobs:
   validate:
     name: Lint & Test
+    permissions:
+      checks: write
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo