fix: least-privilege workflow token permissions

[Wibias]

Problem

OpenSSF Scorecard flags workflow token permissions when write scopes are declared at the workflow top level. That weakens least-privilege defaults: every job inherits the write token unless it overrides permissions, and a future job can silently pick up write access.

Changes

• Move actions: write in .github/workflows/cleanup-orphaned-workflows.yml from top-level permissions to the cleanup job.
• Keep top-level permissions read-only (contents: read) in that workflow.
• Teach the workflow security validator to reject top-level write scopes with top_level_write_forbidden, while still allowing approved job-level writes on allowlisted workflows.
• Add regression coverage for the old top-level write shape and the corrected job-level shape.

Notes

Other workflows already used top-level contents: read with job-level writes where needed (release.yml, create-release-tag.yml, codeql.yml, scorecard.yml). This PR closes the remaining top-level write case and locks the policy in CI.

Verification

• node --test tests/unit/workflow-security.test.mjs — 21/21 pass
• node scripts/validate-repository-security.mjs — valid

[coderabbitai]

Important

Review available on request

• 🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: dd6dfa18-a725-41b2-9f7c-7e40ac6dabd0

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}