ci: harden security-scanning workflows (Scorecard code-scanning alerts)

[seonghobae]

Summary

Remediates the OPEN Scorecard code-scanning alerts that point at workflow files in this repo by applying the secure fix directly. The repo already SHA-pins its other actions and uses least-privilege tokens elsewhere — these were the remaining gaps. No runtime/Python code changed; workflow behaviour is unchanged.

Alerts fixed in code (auto-close on next Scorecard scan of develop)

Token-Permissions (least-privilege GITHUB_TOKEN)

• 🧹 [code health improvement description] #5 security-process.yml — removed top-level security-events: write / actions: read; those write/read scopes now live only on the trivy-fs job that uploads SARIF. appguardrail-scan keeps contents: read.
• 🧪 Add test for _collect_files #4, 🧪 Add test for _scan_file error handling #3 prepare-pypi-release.yml — top-level token reduced to contents: read; actions: write / contents: write / pull-requests: write moved to the single prepare-release job (each is required by its dispatch / commit-push / PR steps).

Pinned-Dependencies (pin actions by commit SHA)

• 🧹 [Code Health] Remove redundant checklist creation for Lovable #7 security-process.yml — aquasecurity/trivy-action v0.36.0 → ed142fd0673e97e23eac54620cfb913e5ce36c25
• 🔒 Fix unbounded file read DoS in scanner #8 security-process.yml — github/codeql-action/upload-sarif v4 → 99df26d4f13ea111d4ec1a7dddef6063f76b97e9 (v4.37.0)
• ⚡ Optimize _scan_file by avoiding redundant string splitting #6 org-security-failure-collector.yml — actions/create-github-app-token v3 → bcd2ba49218906704ab6c1aa796996da409d3eb1 (v3.2.0)

Not addressed here (org/admin policy, not code — central config/tooling)

These Scorecard findings are repository/organization settings or opinionated policy and cannot be fixed by a code change in this repo:

• feat: set up VibeSec initial structure and README #2 Branch-Protection (develop protection settings — admin config)
• 🧪 Add test for _print_scan_results #9 Code-Review (14/22 approved changesets — process metric)
• 🧹 [Code Health] Remove redundant dictionary fallback for severity counts #10 Maintained (repo < 90 days old — temporal; self-resolves as the repo ages)
• 🧪 Add tests for _scan_file functionality #11 CII-Best-Practices (OpenSSF badge — opinionated)
• 🧪 [Add tests for cmd_init configuration generation] #13 Fuzzing (no fuzzer integration — tooling/policy)

None are false positives, so none were dismissed.

🤖 Generated with Claude Code