chore: GHA permissions hardening

[zbynekstara]

Description

Implements two security hardening fixes on GHA workflows:

• Sets permissions: {} at the start of every workflow and grants scopes per job.
• Sets persist-credentials: false as part of all actions/checkout configs. By default, this action writes the run's GITHUB_TOKEN into .git/config as an auth header, where it stays readable by anything that runs later in the same job, but that is not necessary unless an action need to do something (e.g. a push) while relying on those credentials. Changing the default keeps the token out of reach of build and test code, which prevents some attack vectors. Writing to the repository is still allowed if an action supplies its own credentials (like what changeset-release/master does in release.yml).

[Copilot]

Pull request overview

Hardens GitHub Actions workflows across the repo by resetting default GITHUB_TOKEN permissions at the workflow level and granting only the minimal scopes per job, plus disabling credential persistence on actions/checkout to reduce token exposure to build/test code.

Changes:

• Adds permissions: {} at workflow scope and sets explicit per-job permissions.
• Sets persist-credentials: false for actions/checkout usages.
• Cleans up workflow YAML formatting/indentation in a couple of files.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
.github/workflows/test-pr.yml	Resets workflow permissions and constrains the test job token; disables persisted checkout credentials.
.github/workflows/stale.yml	Resets workflow permissions and keeps explicit write permissions for stale automation; fixes schedule indentation.
.github/workflows/sonar.yml	Resets workflow permissions and constrains the Sonar job token; disables persisted checkout credentials.
.github/workflows/release.yml	Applies workflow-level permission reset and disables persisted checkout credentials for the publish job.
.github/workflows/publish-joint-react-docs.yml	Moves Pages permissions from workflow-level to per-job and disables persisted checkout credentials.
.github/workflows/codeql.yml	Resets workflow permissions, keeps explicit CodeQL permissions, and disables persisted checkout credentials.

Suppressed comments (1)

.github/workflows/publish-joint-react-docs.yml:101

• Previously this workflow granted contents: read at the workflow level; after moving to per-job permissions, the deploy job no longer has contents: read. Some Pages steps (e.g., configure/deploy) expect this permission; keeping it here matches the previous effective permissions.

    permissions:
      pages: write # publish the artifact to GitHub Pages
      id-token: write # OIDC token the Pages deployment is verified with

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.