ci: tighten Token-Permissions + add SLSA build provenance to releases

Targets three Scorecard checks:

Token-Permissions (was 0/10)
  build.yml gains an explicit 'permissions: contents: read' top-level
  block. release.yml moves write permissions out of the workflow scope
  into the only job that needs them, and adds id-token + attestations
  for the new provenance step. dev-build.yml, codeql.yml, and
  scorecard.yml were already minimal.

Signed-Releases (was 0/10)
  Adds actions/attest-build-provenance to release.yml. After every
  Release, a SLSA Build Provenance attestation is generated for the
  installer, the portable EXE, and SHA256SUMS.txt; signed via Sigstore
  OIDC and stored in GitHub's public attestation log. Anyone can verify
  a downloaded binary was built from this exact source commit by this
  exact workflow with:

    gh attestation verify GamerGuardian-Setup-x.y.z.exe --owner carterscode

Branch-Protection (was -1, internal error)
  scorecard.yml's analysis step now consumes an optional SCORECARD_TOKEN
  secret (a fine-grained PAT with metadata:read + administration:read).
  When set, Scorecard can read branch-protection rules and score them.
  Falls back to GITHUB_TOKEN when SCORECARD_TOKEN is absent so existing
  runs don't break before the secret is added.

Author: carterscode

.github/workflows/build.yml

@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: windows-latest

.github/workflows/release.yml

@@ -16,7 +16,7 @@ on:
         default: ''
 
 permissions:
-  contents: write
+  contents: read
 
 concurrency:
   group: release
@@ -25,6 +25,10 @@ concurrency:
 jobs:
   release:
     runs-on: windows-latest
+    permissions:
+      contents: write       # create release + tag
+      id-token: write       # mint Sigstore OIDC token for provenance signing
+      attestations: write   # attach SLSA build-provenance attestation
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
@@ -163,6 +167,19 @@ jobs:
           name: GamerGuardian-${{ steps.ver.outputs.version }}-portable
           path: publish/GamerGuardian.exe
 
+      # Generate SLSA Build Provenance attestations for the release artifacts.
+      # GitHub records these in its public attestation log; Sigstore co-signs
+      # them via OIDC. Anyone can verify a downloaded binary was built from
+      # this exact source commit by this exact workflow with:
+      #   gh attestation verify GamerGuardian-Setup-x.y.z.exe --owner carterscode
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+        with:
+          subject-path: |
+            installer/Output/GamerGuardian-Setup-${{ steps.ver.outputs.version }}.exe
+            publish/GamerGuardian.exe
+            installer/Output/SHA256SUMS.txt
+
       - name: Create GitHub Release
         uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
         with:

.github/workflows/scorecard.yml

@@ -29,6 +29,12 @@ jobs:
           results_file: results.sarif
           results_format: sarif
           publish_results: true
+          # SCORECARD_TOKEN is an optional fine-grained PAT with
+          # 'metadata: read' + 'administration: read' on this repo. When set,
+          # the Branch-Protection check can read protection rules and score
+          # them. Without it, that check returns -1 (internal error) because
+          # the default GITHUB_TOKEN can't read admin settings.
+          repo_token: ${{ secrets.SCORECARD_TOKEN || secrets.GITHUB_TOKEN }}
 
       - name: Upload artifact
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2