ci: resolve CodeQL code-scanning alerts in workflows

.github/workflows/bench.yml

@@ -10,12 +10,23 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}${{ github.event_name == 'pull_request_review' && format('-review-{0}', github.run_id) || '' }}
   cancel-in-progress: true
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   file-changes:
     name: Detect File Changes
     if: >
       github.event_name != 'pull_request_review' ||
       github.event.review.user.type != 'Bot'
+    # Job-level permissions replace the workflow default outright rather than
+    # merging with it, so contents must be restated here. paths-filter reads the
+    # PR's changed-file list via pulls.listFiles; this is the only job that needs
+    # it, so it is granted here instead of workflow-wide.
+    permissions:
+      contents: read
+      pull-requests: read
     runs-on: 'ubuntu-latest'
     outputs:
       checkall: ${{ steps.changes.outputs.checkall }}

.github/workflows/claude-code-review.yml

@@ -58,26 +58,17 @@ jobs:
             exit 1
           fi
 
-          PR_HEAD_REF="$(gh pr view "$PR_NUMBER" --repo "${{ github.repository }}" --json headRefName --jq .headRefName)"
-
           echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
-          echo "pr_head_ref=$PR_HEAD_REF" >> "$GITHUB_OUTPUT"
 
+      # Base repo only. This job is privileged (pull_request_target / issue_comment:
+      # it holds secrets and a write-capable token), so the PR head is never checked
+      # out or fetched here. The diff and per-file context are pulled through the gh
+      # API in later steps and treated purely as data.
       - name: Checkout base repo
         uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
-      - name: Fetch PR head
-        shell: bash
-        env:
-          PR_NUMBER: ${{ steps.mode.outputs.pr_number }}
-        run: |
-          set -euo pipefail
-          # Fetch the PR merge ref — works for both same-repo and fork PRs
-          # (fork branches don't exist on origin, but pull/<n>/head always does)
-          git fetch origin "pull/${PR_NUMBER}/head"
-
       - name: Resolve review state
         id: state
         shell: bash

.github/workflows/cleanliness.yml

@@ -10,9 +10,20 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   file-changes:
     name: Detect File Changes
+    # Job-level permissions replace the workflow default outright rather than
+    # merging with it, so contents must be restated here. paths-filter reads the
+    # PR's changed-file list via pulls.listFiles; this is the only job that needs
+    # it, so it is granted here instead of workflow-wide.
+    permissions:
+      contents: read
+      pull-requests: read
     runs-on: 'ubuntu-latest'
     outputs: 
       checkall: ${{ steps.changes.outputs.checkall }}

.github/workflows/convergence.yml

@@ -10,9 +10,20 @@ on:
 env:
   OMPI_MCA_rmaps_base_oversubscribe: 1
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   file-changes:
     name: Detect File Changes
+    # Job-level permissions replace the workflow default outright rather than
+    # merging with it, so contents must be restated here. paths-filter reads the
+    # PR's changed-file list via pulls.listFiles; this is the only job that needs
+    # it, so it is granted here instead of workflow-wide.
+    permissions:
+      contents: read
+      pull-requests: read
     runs-on: ubuntu-latest
     outputs:
       checkall: ${{ steps.changes.outputs.checkall }}

.github/workflows/coverage-health.yml

@@ -4,6 +4,10 @@ on:
   schedule:
     - cron: '0 7 * * *'      # daily; loud if the refresh stopped working
   workflow_dispatch:
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   health:
     if: github.repository == 'MFlowCode/MFC'

.github/workflows/coverage.yml

@@ -11,9 +11,20 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   file-changes:
     name: Detect File Changes
+    # Job-level permissions replace the workflow default outright rather than
+    # merging with it, so contents must be restated here. paths-filter reads the
+    # PR's changed-file list via pulls.listFiles; this is the only job that needs
+    # it, so it is granted here instead of workflow-wide.
+    permissions:
+      contents: read
+      pull-requests: read
     runs-on: 'ubuntu-latest'
     outputs: 
       checkall: ${{ steps.changes.outputs.checkall }}

.github/workflows/docs.yml

@@ -8,6 +8,10 @@ on:
     branches: [master]
   pull_request:
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build & Verify

.github/workflows/formatting.yml

@@ -6,6 +6,10 @@ on:
   pull_request:
   workflow_dispatch:
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   docs:
     name:    Formatting

.github/workflows/fp-stability.yml

@@ -35,9 +35,20 @@ on:
     types: [opened, synchronize, reopened, ready_for_review]
   workflow_dispatch:
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   file-changes:
     name: Detect File Changes
+    # Job-level permissions replace the workflow default outright rather than
+    # merging with it, so contents must be restated here. paths-filter reads the
+    # PR's changed-file list via pulls.listFiles; this is the only job that needs
+    # it, so it is granted here instead of workflow-wide.
+    permissions:
+      contents: read
+      pull-requests: read
     runs-on: ubuntu-latest
     outputs:
       checkall: ${{ steps.changes.outputs.checkall }}

.github/workflows/homebrew-release.yml

@@ -21,6 +21,10 @@ on:
         type: boolean
         default: false
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   update-homebrew-tap:
     name: Update homebrew-mfc tap

.github/workflows/homebrew.yml

@@ -11,6 +11,10 @@ on:
       - '.github/workflows/homebrew.yml'
   workflow_dispatch:
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   # Fast smoke tests that run before expensive operations
   smoke-test:

.github/workflows/lint-toolchain.yml

@@ -6,6 +6,10 @@ on:
   pull_request:
   workflow_dispatch:
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   lint-toolchain:
     name:    Lint Toolchain

.github/workflows/pmd.yml

@@ -6,6 +6,10 @@ on:
   pull_request:
   workflow_dispatch:
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:    
   pmd:
       name: PMD

.github/workflows/spelling.yml

@@ -6,6 +6,10 @@ on:
   pull_request:
   workflow_dispatch:
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   run:
     name: Spell Check

.github/workflows/test-toolchain-compat.yml

@@ -6,6 +6,10 @@ on:
   pull_request:
   workflow_dispatch:
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   test-toolchain:
     name: "Python ${{ matrix.python-version }}"

.github/workflows/test.yml

@@ -12,6 +12,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.sha || github.ref }}
   cancel-in-progress: ${{ github.event_name != 'push' }}
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   lint-gate:
     name: Lint Gate
@@ -50,6 +54,13 @@ jobs:
 
   file-changes:
     name: Detect File Changes
+    # Job-level permissions replace the workflow default outright rather than
+    # merging with it, so contents must be restated here. paths-filter reads the
+    # PR's changed-file list via pulls.listFiles; this is the only job that needs
+    # it, so it is granted here instead of workflow-wide.
+    permissions:
+      contents: read
+      pull-requests: read
     runs-on: 'ubuntu-latest'
     outputs:
       checkall: ${{ steps.changes.outputs.checkall }}