🦅 [gha] improve security

[chicks-net]

Context

fini-net/fini-infra#15

Done:

• 🦅 [gha] improve security

(Automated in justfile.)

[Copilot]

Pull Request Overview

This PR improves GitHub Actions security by implementing the principle of least privilege for workflow permissions. The changes replace global read-all permissions with minimal scoped permissions at the job level.

• Removes global read-all permissions and sets global permissions to empty
• Adds specific job-level permissions with minimal required scopes
• Ensures each workflow only has access to the resources it actually needs

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.github/workflows/markdownlint.yml	Restricts permissions to only contents: read for linting markdown files
.github/workflows/checkov.yml	Removes global permissions, keeps existing job-level security scanning permissions
.github/workflows/auto-assign.yml	Adds contents: read permission to existing issue/PR write permissions

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}