Refactor build workflows

.github/workflows/ai-assistance.yaml

@@ -8,6 +8,9 @@ jobs:
     name: PR Summary
     if: github.actor != 'ospo-renovate[bot]'
     runs-on: [ubuntu-latest]
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: SAP/ai-assisted-github-actions/pr-summary@93162bffd6b396623ffa5b20e4666e427db88414 # v3.0.2
         with:
@@ -21,6 +24,9 @@ jobs:
     name: PR Review
     if: github.actor != 'ospo-renovate[bot]'
     runs-on: [ubuntu-latest]
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: SAP/ai-assisted-github-actions/pr-review@93162bffd6b396623ffa5b20e4666e427db88414 # v3.0.2
         with:

.github/workflows/build-cleanup.yaml

@@ -13,6 +13,8 @@ jobs:
   clean-up:
     name: Clean up
     runs-on: [ubuntu-latest]
+    permissions:
+      contents: write
     steps:
       - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:

.github/workflows/build.yaml

@@ -16,6 +16,8 @@ jobs:
     name: Build and push artifacts to release branch
     runs-on: [ubuntu-latest]
     if: ${{ !startsWith(github.head_ref || github.ref_name, 'release/') }}
+    permissions:
+      contents: write
     steps:
       - name: Checkout source branch
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -90,11 +92,14 @@ jobs:
           git commit -m "${{ github.event.number && format('PR-{0}', github.event.number) || join(github.event.commits.*.message, ', ') }}" || true
           git push
 
-  testing:
-    name: Execute the AI-assisted action defined in this PR
+  testing-summary:
+    name: Execute the action (PR Summary) defined in this PR
     runs-on: [ubuntu-latest]
     needs: create-release
     if: ${{ github.ref_name != 'main' }}
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Checkout release branch
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -104,14 +109,28 @@ jobs:
         uses: ./pr-summary # action.yml is in the pr-summary folder of the release branch
         with:
           aicore-service-key: ${{ secrets.AICORE_SERVICE_KEY }}
-          model: gpt-4o
+          model: o3
           exclude-files: package-lock.json
           display-mode: comment-delta
-      - name: Run the AI-assisted action (PR Summary)
+
+  testing-review:
+    name: Execute the action (PR Review) defined in this PR
+    runs-on: [ubuntu-latest]
+    needs: create-release
+    if: ${{ github.ref_name != 'main' }}
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Checkout release branch
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ env.RELEASE_BRANCH }}
+      - name: Run the AI-assisted action (PR Review)
         uses: ./pr-review # action.yml is in the pr-review folder of the release branch
         with:
           aicore-service-key: ${{ secrets.AICORE_SERVICE_KEY }}
-          model: gpt-4o
+          model: o3
           exclude-files: package-lock.json
           display-mode: review-comment-delta
 
@@ -120,6 +139,8 @@ jobs:
     runs-on: [ubuntu-latest]
     needs: create-release
     if: ${{ github.ref_name == 'main' }}
+    permissions:
+      contents: write
     steps:
       - name: Checkout release branch
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

.github/workflows/code-quality.yaml

@@ -12,6 +12,8 @@ jobs:
   lintCheck:
     runs-on: [ubuntu-latest]
     name: Linter (${{ matrix.path }})
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -35,6 +37,8 @@ jobs:
   formatCheck:
     runs-on: [ubuntu-latest]
     name: Formatter (${{ matrix.path }})
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix: