chore: harden GitHub Actions token permissions

.github/workflows/javadoc-generation.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-26.04
     timeout-minutes: 60
     permissions:
-      contents: write     # Needed for checkout and potential deployment
+      contents: read      # Needed for checkout
       pages: write        # Needed for GitHub Pages deployment
       id-token: write     # Required for attestation
       actions: read       # Basic read access to actions

.github/workflows/release.yml

@@ -21,15 +21,10 @@ jobs:
       cancel-in-progress: true
     permissions:
       contents: write     # Needed for checkout, git-auto-commit-action, and creating releases
-      packages: write     # Needed for publishing packages
       id-token: write    # Required for SLSA provenance and SBOM attestation
       actions: read      # Basic read access to actions
-      security-events: write  # Needed for SBOM attestation
-      statuses: write    # Required for commit statuses updated by actions
       issues: write       # Updated to write for release-drafter
       pull-requests: write    # Updated to write for release-drafter      
-      pages: read
-      deployments: write
       attestations: write # Required to create and persist attestations
     strategy:
       fail-fast: false

.github/workflows/site-generation.yml

@@ -17,9 +17,7 @@ jobs:
     runs-on: ubuntu-26.04
     timeout-minutes: 120
     permissions:
-      contents: write     # Needed for checkout and potential site deployment
-      pages: write        # Needed for GitHub Pages deployment
-      id-token: write     # Required for attestation
+      contents: read      # Needed for checkout
       actions: read       # Basic read access to actions
 
     steps: