chore: harden GitHub Actions token permissions

[Copilot]

Description

Reduces GitHub Actions permissions flagged by OpenSSF Scorecard where workflow steps do not require write access. Required release, attestation, and scheduled-report permissions remain unchanged.

Type of Change

Primary Changes

• 🚀 New Feature
• 🔄 Enhancement
• 🐛 Bug Fix
• 📦 Dependency Update

Political Analysis

• 📊 Political Data Analysis
  • Party Analysis
  • Committee Processing
  • Government Data
  • Riksdagen Integration
• 📈 Analytics & Metrics
  • Performance Metrics
  • Risk Assessment
  • Decision Analysis
  • Transparency Metrics

Technical Changes

• 🎨 UI/UX Changes
  • Layout Updates
  • Form Improvements
  • Visualization Updates
• 🏗️ Infrastructure
  • Database Changes
  • Performance Optimization
  • Configuration Updates
• 🔒 Security & Compliance
  • Authentication
  • Authorization
  • Data Protection
• 📝 Documentation
  • Technical Documentation
  • User Documentation
  • API Documentation
• ✅ Testing
  • Unit Tests
  • Integration Tests
  • Performance Tests

Impact Analysis

Political Analysis Impact

• Impact on data quality: None.
• Impact on analysis accuracy: None.
• Impact on transparency features: None.

Technical Impact

• Performance impact: None.
• Security implications: Narrows GITHUB_TOKEN scopes.
• Dependency changes: None.

Testing

• Unit tests added/updated
• Integration tests added/updated
• Political data validation completed
• Security compliance verified
• Performance testing completed

Documentation

• JavaDoc updated
• README updated
• API documentation updated
• Package/module documentation updated
• Political analysis documentation updated

Screenshots

Not applicable.

Related Issues

Checklist

• Code follows project coding standards
• Comments are clear and helpful
• Documentation is updated
• Tests are passing
• Security compliance is maintained
• Performance impact is acceptable
• Breaking changes are documented
• Changes are backward compatible

Additional Notes

Permission reductions

• Javadoc and Maven Site jobs: contents: write → contents: read.
• Release job: removed unused packages, security-events, statuses, and deployments write scopes.

permissions:
  contents: read

Security Considerations

• No sensitive data exposed
• Security best practices followed
• Compliance requirements met

Release Notes

Reduced GitHub Actions token permissions for documentation, site-generation, and release workflows.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA ebfc888.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None

[Copilot]

Pull request overview

This PR hardens CI/CD security by reducing GitHub Actions GITHUB_TOKEN permissions in documentation/site and release workflows, aligning with least-privilege expectations (e.g., OpenSSF Scorecard findings) while keeping required release/attestation capabilities intact.

Changes:

• Reduce contents permission from write to read in site and Javadoc generation workflows.
• Remove unused write-scopes from the release workflow permissions block (e.g., packages, statuses, deployments, security-events).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/site-generation.yml	Narrows repository content access for the Maven site generation job.
.github/workflows/javadoc-generation.yml	Narrows repository content access for the Javadoc generation job.
.github/workflows/release.yml	Removes several unused GITHUB_TOKEN scopes from the release job permissions.

Comments suppressed due to low confidence (1)

.github/workflows/javadoc-generation.yml:33

• This job uses github.rest.issues.createComment(...) to comment on PRs, which requires issues: write. Currently only pull-requests: write is granted, so the PR-comment step is likely to fail. Also, pages: write and id-token: write are granted but unused in this workflow (no Pages deploy / attestation steps).

      contents: read      # Needed for checkout
      pages: write        # Needed for GitHub Pages deployment
      id-token: write     # Required for attestation
      actions: read       # Basic read access to actions
      pull-requests: write

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud