fix: openssf scoreboard points

.github/workflows/ci.yaml

@@ -22,11 +22,9 @@ on:
         type: string
         description: "Override the tag of the dir-ctl Docker image to use in the tests."
 
+# Declare default permissions as read-only; jobs that need more request it explicitly.
 permissions:
-  contents: write
-  packages: write
-  id-token: write
-  pull-requests: write
+  contents: read
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -97,6 +95,10 @@ jobs:
     name: Test
     needs:
       - changes
+    permissions:
+      id-token: write
+      contents: read
+      packages: read
     uses: ./.github/workflows/reusable-test-sdk.yaml
     with:
       dir_chart_version: ${{ inputs.dir_chart_version }}
@@ -108,6 +110,9 @@ jobs:
     needs:
       - lint
       - test
+    permissions:
+      contents: read
+      id-token: write # Required for npm OIDC trusted publishing
     uses: ./.github/workflows/reusable-release-sdk.yaml
 
   success:

.github/workflows/codeql.yml

@@ -3,6 +3,9 @@
 
 name: "CodeQL Advanced"
 
+# Declare default permissions as none; the analyze job grants exactly what it needs.
+permissions: {}
+
 on:
   push:
     branches:
@@ -51,12 +54,12 @@ jobs:
           echo "📦 Installing JavaScript/TypeScript dependencies..."
           # Install dependencies for JavaScript SDK
           if [ -f "package.json" ]; then
-            npm ci || npm install
+            npm ci
           fi
           # Install dependencies for examples
           if [ -f "examples/package.json" ]; then
             cd examples
-            npm ci || npm install
+            npm ci
             cd ..
           fi
           echo "✅ JavaScript/TypeScript dependencies installed"

.github/workflows/dependencies.yaml

@@ -5,6 +5,11 @@ on:
   schedule:
     - cron: "0 */6 * * *"
 
+# Declare default permissions as read-only; the job authenticates via the
+# GitHub App token instead of relying on the default GITHUB_TOKEN.
+permissions:
+  contents: read
+
 jobs:
   renovate:
     name: Renovate Sync

package.json

@@ -86,6 +86,6 @@
   "author": "",
   "allowScripts": {
     "fsevents@2.3.3": true,
-    "protobufjs@7.6.4": true
+    "protobufjs@7.6.6": true
   }
 }

renovate.json

@@ -59,7 +59,10 @@
   ],
   "osvVulnerabilityAlerts": true,
   "lockFileMaintenance": {
-    "enabled": true
+    "enabled": true,
+    "schedule": [
+      "at any time"
+    ]
   },
   "packageRules": [
     {