fix: harden GitHub Actions workflows against script injection and over-privileged tokens

.github/workflows/publish.yml

@@ -1,13 +1,14 @@
 on:
   push:
 
-permissions:
-  contents: write
-  pull-requests: write
+permissions: read-all
 
 name: Publish release
 jobs:
   update-action-references:
+    permissions:
+      contents: write
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - name: Check-out source code
@@ -29,6 +30,9 @@ jobs:
 
   release:
     if: github.ref == 'refs/heads/main'
+    permissions:
+      contents: write
+      pull-requests: write
     runs-on: ubuntu-latest
     needs: update-action-references
     steps:

.github/workflows/update-repo-docs.yml

@@ -10,4 +10,6 @@ on:
 
 jobs:
   update-repo-docs:
+    permissions:
+      contents: write
     uses: fortify/shared-doc-resources/.github/workflows/update-repo-docs.yml@main

action.yml

@@ -20,7 +20,7 @@ runs:
     - name: Set Fortify data directory
       run: echo "FORTIFY_DATA_DIR=${{ runner.temp }}/fortify-data" >> $GITHUB_ENV
       shell: bash
-    - uses: fortify/github-action/setup@main
+    - uses: fortify/github-action/setup@mjain6/review-github-actions-vulnerabilities
       with:
         fcli: bootstrapped
         export-path: false