Workflows declare least-privilege permissions
The default token permission set is broad enough that a compromised build step can push commits or publish a release. A read-only default costs one line and turns most injection findings into nothing.
Observable check
every workflow file sets a top-level permissions: block that grants no more than contents: read, and any job needing more declares the extra scope at the job level.