Scope GitHub Actions token permissions to least-privilege (OpenSSF Scorecard: Token-Permissions)

[swperb]

OpenSSF Scorecard — Token-Permissions (currently 0/10). The dependabot-automerge workflow grants its GITHUB_TOKEN write scopes at the top level, so every step in the run gets write access. Scorecard (and least-privilege best practice) wants the top level read-only, with write granted only on the job that needs it.

What to change — .github/workflows/dependabot-automerge.yml

Move the two write scopes from the top level onto the automerge job:

# top level → read-only
permissions:
  contents: read

jobs:
  automerge:
    # grant write only here, where the merge happens
    permissions:
      contents: write
      pull-requests: write
    runs-on: ubuntu-latest
    # ...rest unchanged

That's the whole change — same scopes, just scoped to the job instead of the run.

Done when

• Top-level permissions: is contents: read
• The automerge job declares contents: write + pull-requests: write
• The workflow still auto-merges Dependabot PRs (logic is unchanged; it'll exercise on the next Dependabot PR)

Notes

• Don't touch release.yml's job-level contents: write (lines ~39/140) — those are needed to upload release assets and Scorecard only soft-warns on them.
• This is CI-security-sensitive: keep the exact scopes, only relocate them.

Difficulty: easy–medium. A common, well-defined OSS hardening task.