Harden GitHub Actions token scope and remediate Scorecard OSV CVEs

[Copilot]

This PR addresses Scorecard findings for over-permissive GITHUB_TOKEN usage across workflows and vulnerable dependencies in the scripts toolchain. It applies least-privilege permissions in workflows and updates affected packages tied to the reported OSV advisories.

• Workflow permission hardening (least privilege)

  • Added permissions: read-all at workflow top level across active workflows in .github/workflows/.
  • Moved write access to job-level permissions only where required (e.g., PR commenting, checks/status updates, content pushes, SARIF/id-token usage).
  • Preserved existing pull_request_target guards/conditions and workflow behavior patterns.

• OSV vulnerability remediation (scripts/package.json)

  • Upgraded yaml to ^2.8.3 to address GHSA-48c2-rrv3-qjmp (DoS).
  • Upgraded vitest to ^4.1.8, which pulls patched transitive versions for:
    • esbuild (GHSA-67mh-4wv8-2f99)
    • postcss (GHSA-qx2v-qp2m-jg93)
    • vite (GHSA-4w7w-66w2-5vf9)
  • Updated scripts/package-lock.json accordingly.

• Representative permission pattern

  permissions:
    read-all
  
  jobs:
    analysis:
      permissions:
        security-events: write
        id-token: write

[kubestellar-prow]

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.

📝 Please follow instructions in the contributing guide to update your commits with the DCO

Full details of the Developer Certificate of Origin can be found at developercertificate.org.

The list of commits missing DCO signoff:

• 3b49880 Initial plan
• 4baa5cc harden workflow token permissions and update vulnerable script deps

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from clubanderson. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[clubanderson]

✅ sec-check: Correct permission scoping — with important ordering note

The permission changes are correct: workflow-level read-all + job-level write grants are the right pattern.

Verified workflows (permissions moved to job level correctly):

• add-help-wanted.yml, assignment-helper.yml → issues: write at job level ✅
• ai-fix.yml → contents/issues/pull-requests: write at job level ✅
• copilot-automation.yml → contents/pull-requests/issues/statuses: write at job level ✅
• build-index.yml, cncf-install-gen.yml, cncf-mission-gen.yml → write at job level ✅
• copilot-dco.yml → explicit checks: write, pull-requests: read ✅

⚠️ IMPORTANT: Merge order required

ai-fix.yml and copilot-automation.yml use pull_request_target with write permissions but lack fork guards in the current main branch. PR #2461 adds those fork guards.

Merge order: #2461 (fork guards) MUST be merged BEFORE this PR to avoid a window where pull_request_target workflows have write permissions but no fork protection.

Action needed:

1. Get DCO sign-off on ci: add fork guards and pin infra workflow SHA refs in console-kb #2461 first
2. Get DCO sign-off on this PR
3. Merge ci: add fork guards and pin infra workflow SHA refs in console-kb #2461 → rebase this PR → merge this PR

---

Filed by sec-check agent (ACMM L6 — full mode)

[kubestellar-prow]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[kubestellar-hive]

Closing — this PR has merge conflicts and missing DCO sign-off. If the fix is still needed, please rebase and re-submit with git commit -s.