chore(ci): least privilege workflow permissions

[DerekRoberts]

Summary

This PR updates all GitHub Actions workflows to enforce least privilege permissions as required by copilot.md and BC Gov standards. Top-level permissions are now set to . No job-level permissions were changed unless already present.

---

Thanks for the PR!

Any successful deployments (not always required) will be available below.
API available
Frontend available

Once merged, code will be promoted and handed off to following workflow run.
Main Merge Workflow

[Copilot]

Pull request overview

This PR attempts to enforce least-privilege GitHub Actions permissions by adding explicit permissions blocks to multiple workflows.

Changes:

• Adds workflow-level permissions: contents: read to several workflows.
• Adds additional permissions: {} entries near the end of multiple workflow files.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
.github/workflows/scheduled.yml	Adds workflow permissions; also introduces a second permissions key at EOF.
.github/workflows/merge.yml	Adds workflow permissions; inserts a top-level permissions: {} inside the jobs: section.
.github/workflows/analysis.yml	Adds workflow permissions; also adds a second permissions key at EOF.
.github/workflows/.tests.yml	Adds workflow permissions; also adds a second permissions key at EOF.
.github/workflows/.deploy.yml	Adds workflow permissions but breaks workflow_call.inputs indentation; also adds a second permissions key at EOF.

Comments suppressed due to low confidence (5)

.github/workflows/analysis.yml:43

• permissions: {} at the end of the workflow introduces a duplicate top-level permissions key which overrides the earlier contents: read setting. This can leave the workflow with no token permissions and break actions/checkout / SARIF upload. Remove this trailing permissions: {} and use job-level permissions only where overrides are needed.
  .github/workflows/.deploy.yml:123
• permissions: {} at the end of the file introduces a second top-level permissions key, overriding the earlier contents: read permission (and in this file’s case, it also appears after the jobs definition). Remove this trailing key; use job-level permissions only where an override is required.
  .github/workflows/scheduled.yml:142
• permissions: {} at the end of the workflow creates a second top-level permissions key. In YAML the last key wins, so this will override contents: read and can leave the workflow with no token permissions (breaking actions/checkout and other API calls). Remove this trailing permissions: {}; if you need per-job overrides, put permissions blocks under the specific jobs instead.
  .github/workflows/.tests.yml:36
• permissions: {} at the end of the workflow creates a second top-level permissions key. In YAML this will override the earlier contents: read permission and can break actions/checkout (and any API calls) by leaving the token with no scopes. Remove this trailing permissions: {}; if a specific job needs different permissions, set them under that job.
  .github/workflows/.deploy.yml:35
• The new workflow-level permissions block is inserted before the rest of the workflow_call.inputs entries, but the remaining inputs (directory, timeout-minutes, etc.) are still indented as if they are under on.workflow_call.inputs. This makes the YAML invalid and/or removes those inputs from the reusable workflow contract. Move permissions to a valid top-level position (after on:) and fix indentation so all inputs remain under on.workflow_call.inputs.

permissions: {}

      ### Usually a bad idea / not recommended
      directory:
        description: "Chart directory"
        default: "charts/${{ github.event.repository.name }}"
        required: false
        type: string
      timeout-minutes:
        description: "Timeout minutes"

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.

Comments suppressed due to low confidence (1)

.github/workflows/merge.yml:60

• Because the workflow sets permissions: {} at the top level, the deploys/tests/deploys-prod jobs (which call reusable workflows via uses: ./.github/workflows/...) will run with no GITHUB_TOKEN scopes unless you add job-level permissions. Reusable workflows can’t increase permissions beyond the caller, so these caller jobs need to grant at least contents: read for the called workflows’ actions/checkout steps (and any other scopes they require).

  deploys:
    name: TEST Deployments
    needs: [retag-images, semantic-version]
    uses: ./.github/workflows/.deploy.yml
    secrets: inherit

[mishraomp]

lgtm, thanks