[WIP] Add minimum token permissions for all github workflow files

[Copilot]

Add minimum token permissions for all GitHub workflow files to improve security posture according to OpenSSF Scorecard recommendations.

Plan:

Step 1: Add Root-Level Permissions

• Analyze current state - 16 files need root-level permissions added
• Identify formatting patterns - Rule B applies (blank lines above/below permissions)
• Create formatting analysis tools
• Add permissions: contents: read to 16 workflow files
  • backport.yml
  • changelog.yml
  • codeql-analysis.yml
  • component-owners.yml
  • core_contrib_test_0.yml
  • lint_0.yml
  • misc_0.yml
  • package-prepare-patch-release.yml
  • package-prepare-release.yml
  • package-release.yml
  • prepare-patch-release.yml
  • prepare-release-branch.yml
  • release.yml
  • test_0.yml
  • test_1.yml
  • test_2.yml

Step 2: Add Job-Level Permissions

• Analyze workflows that use secrets.GITHUB_TOKEN
• Add appropriate write permissions for:
  • release.yml (needs contents: write for creating releases)
  • package-release.yml
  • prepare-release-branch.yml
  • package-prepare-patch-release.yml
  • prepare-patch-release.yml

Step 3: Handle Reusable Workflows

• Check for any local reusable workflow calls (none found so far)

Files already compliant:

• ✅ fossa.yml (has permissions: contents: read)
• ✅ ossf-scorecard.yml (has permissions: read-all)

Fixes #5.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[trask]

@copilot try again