Backport workflow-hardening fix (excessive-permissions) to 4 release branches

[CharlieMCY]

Summary

The default branch already hardened .github/workflows/ci.yml against the issue(s) below, but 4 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)

• excessive-permissions — workflow/job granted broader permissions than needed

Already resolved on the default branch in:

• 72637a4

Affected release branches (4)

• 0.4.18 (still present as of HEAD d999f371)
• 0.4.17 (still present as of HEAD 5a2523d6)
• 0.4.12 (still present as of HEAD e30ad419)
• 0.4.15 (still present as of HEAD 34e08926)

Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

0.4.18 — excessive-permissions

File .github/workflows/ci.yml; suggested edits:

• • jobs.$J.permissions.pull-requests = 'write'

--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -82,6 +82,8 @@
           matching-threshold: 0.5
           artifact-name: wasm
 
+    permissions:
+      pull-requests: write
   lint:
     name: Clippy
     runs-on: ubuntu-latest

0.4.17 — excessive-permissions

File .github/workflows/ci.yml; suggested edits:

• • jobs.$J.permissions.pull-requests = 'write'

--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -80,6 +80,8 @@
       - run: rustup target add wasm32-unknown-unknown
       - run: cd docx-wasm && yarn install && yarn wasm-pack:node && yarn wasm-pack:dev && tsc -p tsconfig.node.json && yarn test
 
+    permissions:
+      pull-requests: write
   lint:
     name: Clippy
     runs-on: ubuntu-latest

0.4.12 — excessive-permissions

File .github/workflows/ci.yml; suggested edits:

• • jobs.$J.permissions.pull-requests = 'write'

--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -80,6 +80,8 @@
       - run: rustup target add wasm32-unknown-unknown
       - run: cd docx-wasm && yarn install && yarn wasm-pack:node && yarn wasm-pack:dev && tsc -p tsconfig.node.json && yarn test
 
+    permissions:
+      pull-requests: write
   lint:
     name: Clippy
     runs-on: ubuntu-latest

0.4.15 — excessive-permissions

File .github/workflows/ci.yml; suggested edits:

• • jobs.$J.permissions.pull-requests = 'write'

--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -80,6 +80,8 @@
       - run: rustup target add wasm32-unknown-unknown
       - run: cd docx-wasm && yarn install && yarn wasm-pack:node && yarn wasm-pack:dev && tsc -p tsconfig.node.json && yarn test
 
+    permissions:
+      pull-requests: write
   lint:
     name: Clippy
     runs-on: ubuntu-latest

---

Happy to open pull requests instead if that's preferred.