Harden GitHub Actions workflows

[thaJeztah]

Apply hardening from zizmor (https://github.com/zizmorcore/zizmor);

zizmor --fix=all --min-severity=medium --pedantic .

warning[excessive-permissions]: overly broad permissions
  --> ./.github/workflows/check-commit-message.yaml:10:1
   |
10 | permissions: read-all
   | ^^^^^^^^^^^^^^^^^^^^^ uses read-all permissions
   |
   = note: audit confidence → High

warning[excessive-permissions]: overly broad permissions
  --> ./.github/workflows/codeql.yaml:14:1
   |
14 | permissions: read-all
   | ^^^^^^^^^^^^^^^^^^^^^ uses read-all permissions
   |
   = note: audit confidence → High

warning[excessive-permissions]: overly broad permissions
  --> ./.github/workflows/files.yaml:12:1
   |
12 | permissions: read-all
   | ^^^^^^^^^^^^^^^^^^^^^ uses read-all permissions
   |
   = note: audit confidence → High

warning[excessive-permissions]: overly broad permissions
  --> ./.github/workflows/forbid-merge-commits.yaml:10:1
   |
10 | permissions: read-all
   | ^^^^^^^^^^^^^^^^^^^^^ uses read-all permissions
   |
   = note: audit confidence → High

warning[excessive-permissions]: overly broad permissions
  --> ./.github/workflows/go.yaml:12:1
   |
12 | permissions: read-all
   | ^^^^^^^^^^^^^^^^^^^^^ uses read-all permissions
   |
   = note: audit confidence → High

warning[template-injection]: code injection via template expansion
  --> ./.github/workflows/go.yaml:30:54
   |
30 |       run: make test lint v=1 cover=1 GO-VERSION=${{ matrix.go-version }}
   |       --- this run block                             ^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → Medium
   = note: this finding has an auto-fix

22 findings (16 ignored, 1 unsafe fixes): 0 informational, 0 low, 6 medium, 0 high

After this patch:

zizmor --fix=all --min-severity=medium .
INFO zizmor: 🌈 zizmor v1.26.1
INFO audit: zizmor: 🌈 completed ./.github/dependabot.yaml
INFO audit: zizmor: 🌈 completed ./.github/workflows/check-commit-message.yaml
INFO audit: zizmor: 🌈 completed ./.github/workflows/codeql.yaml
INFO audit: zizmor: 🌈 completed ./.github/workflows/files.yaml
INFO audit: zizmor: 🌈 completed ./.github/workflows/forbid-merge-commits.yaml
INFO audit: zizmor: 🌈 completed ./.github/workflows/go.yaml
No findings to report. Good job! (1 ignored, 15 suppressed)
No fixes available to apply.

[Copilot]

Pull request overview

This PR hardens the repository’s GitHub Actions workflows to satisfy zizmor’s medium+ findings by narrowing default token permissions and addressing a template-expansion injection warning in the Go workflow.

Changes:

• Replaced workflow-level permissions: read-all with least-privilege permissions: { contents: read } across multiple workflows.
• Tightened CodeQL job permissions while preserving required security-events: write.
• Mitigated a zizmor template-expansion warning in .github/workflows/go.yaml by passing the matrix value via env.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/go.yaml	Restricts default token permissions and avoids direct ${{ matrix.* }} expansion in a run: command by using env.
.github/workflows/forbid-merge-commits.yaml	Restricts default token permissions to read-only repository contents.
.github/workflows/files.yaml	Restricts default token permissions to read-only repository contents for linting workflows.
.github/workflows/codeql.yaml	Restricts workflow permissions and explicitly scopes CodeQL job permissions needed for analysis upload.
.github/workflows/check-commit-message.yaml	Restricts default token permissions to read-only repository contents for commit message checks.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ccoVeille]

Thank you

[ccoVeille]

Please fix the error reported by the CI

[thaJeztah]

@ccoVeille think it should be fixed now; updated commit message and added quotes 👍

[ccoVeille]

Line 1: Fix zizmor linting

• Line 1: Subject should be longer than 20 characters (current: 18)

[thaJeztah]

OK, fluffed up the commit title to please the linter 😂