chore(workflows): apply best-practice hardening across all reusable workflows

.github/workflows/issue-welcome.yml

@@ -3,6 +3,8 @@ name: Issue Welcome (Reusable)
 on:
   workflow_call:
 
+permissions: {}
+
 jobs:
   welcome:
     runs-on: ubuntu-latest

.github/workflows/octo-ci-status.yml

@@ -37,13 +37,14 @@ on:
       OCTO_BOT_TOKEN:
         required: true
 
-permissions:
-  actions: read
+permissions: {}
 
 jobs:
   notify:
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      actions: read
     steps:
       - name: Notify Octo IM
         env:

.github/workflows/reusable-pr-labeler.yml

@@ -21,6 +21,7 @@ permissions: {}
 jobs:
   label:
     name: Label PR size and detect dependency changes
+    timeout-minutes: 10
     permissions:
       issues: write
       pull-requests: write

.github/workflows/reusable-release-drafter.yml

@@ -14,6 +14,7 @@ permissions: {}
 jobs:
   draft:
     name: Update Release Draft
+    timeout-minutes: 10
     permissions:
       contents: write
       pull-requests: read

.github/workflows/reusable-release-publish.yml

@@ -27,6 +27,7 @@ permissions: {}
 jobs:
   publish:
     name: Publish GitHub Release (${{ inputs.tag }})
+    timeout-minutes: 15
     permissions:
       contents: write
       actions: read  # required to query workflow run status and head SHA

.github/workflows/reusable-stale.yml

@@ -29,6 +29,7 @@ jobs:
       issues: write
       pull-requests: write
     runs-on: ubuntu-24.04
+    timeout-minutes: 30
     steps:
       - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9
         with:
@@ -65,6 +66,7 @@ jobs:
       issues: write
       pull-requests: write
     runs-on: ubuntu-24.04
+    timeout-minutes: 30
     steps:
       - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9
         with:
@@ -92,6 +94,7 @@ jobs:
       issues: write
       pull-requests: write
     runs-on: ubuntu-24.04
+    timeout-minutes: 30
     steps:
       - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9
         with:

.github/workflows/workflow-sanity.yml

@@ -15,8 +15,7 @@ on:
       - '.github/actions/**'
   workflow_dispatch:
 
-permissions:
-  contents: read
+permissions: {}
 
 concurrency:
   group: workflow-sanity-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -26,6 +25,9 @@ jobs:
   no-tabs:
     name: No tabs in workflow files
     runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -61,6 +63,9 @@ jobs:
   actionlint:
     name: actionlint
     runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4