fix Token permissions (#6910)

* fix Token permissions

https://github.com/Hack23/cia/security/code-scanning/83

* fix fix Token permissions

https://github.com/Hack23/cia/security/code-scanning/82

* fix Token permissions

.github/workflows/codeql-analysis.yml

@@ -17,17 +17,17 @@ on:
 env:
   javaVersion: java21
 
-permissions:
-  contents: write
-  security-events: write
-  pull-requests: read
-
+permissions: read-all
 
 jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-24.04
-
+    permissions:
+      contents: write        # Required for dependency submission and repository access
+      security-events: write # Required for CodeQL, checkov, and dependency submission
+      pull-requests: read   # Needed for PR analysis
+      actions: read         # Needed for CodeQL action metadata
     strategy:
       fail-fast: false
       matrix:

.github/workflows/release.yml

@@ -5,15 +5,25 @@ on:
       release:
         description: 'Version to release'
         required: true
-permissions: write-all
+
+permissions: read-all
+
 env:
   javaVersion: java21
 
 jobs:
   release:
     name: Release
     runs-on: ubuntu-24.04
-
+    permissions:
+      contents: write     # Needed for checkout, git-auto-commit-action, and creating releases
+      packages: write     # Needed for publishing packages
+      id-token: write    # Required for SLSA provenance and SBOM attestation
+      actions: read      # Basic read access to actions
+      security-events: write  # Needed for SBOM attestation
+      statuses: write    # Required for commit statuses updated by actions
+      issues: read       # Needed for release notes generation capability
+      pull-requests: read    # Access for potential PR-related operations
     strategy:
       fail-fast: false