security: adopt supply chain security defaults

.github/dependabot.yml

@@ -5,6 +5,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     reviewers:
       - "GitHubSecurityLab/codeql-community-packs-admin"
     target-branch: "main"

.github/workflows/ci.yml

@@ -5,10 +5,20 @@ on:
     branches: [ main ]
   workflow_dispatch:
 
+# Least-privilege default; jobs that need to comment on PRs override this below.
+permissions:
+  contents: read
+  packages: read
+
 jobs:
   compile-and-test:
     runs-on: ubuntu-latest
-
+    permissions:
+      contents: read
+      pull-requests: write # required by pr-suites-packs.sh (gh pr comment)
+      issues: write # required by pr-suites-packs.sh (gh pr comment)
+      packages: read # required by pr-suites-packs.sh (gh api packages)
+
     strategy:
       fail-fast: false
       matrix:
@@ -217,7 +227,10 @@ jobs:
   configs:
     runs-on: ubuntu-latest
     needs: compile-and-test
-
+    permissions:
+      contents: read
+      pull-requests: read # required by pr-configs.sh (gh pr view)
+
     steps:
       - uses: actions/checkout@v7
 

.github/workflows/hotspots.yml

@@ -61,7 +61,7 @@ jobs:
       - name: Patch the CodeQL distro
         working-directory: codeql-community-packs
         run: |
-          pip install pandas
+          pip install --require-hashes -r ql/hotspots/requirements.txt
           python ql/hotspots/scripts/generate-hotspots-queries.py \
             --ql-extractor "$GITHUB_WORKSPACE/codeql/ql/extractor-pack" \
             --ql-path "$GITHUB_WORKSPACE/codeql"

.github/workflows/update-release.yml

@@ -16,6 +16,8 @@ on:
 jobs:
   update-release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # PR creation uses a scoped GitHub App token (SECLABS_APP_ID/SECLABS_APP_KEY), not GITHUB_TOKEN
 
     steps:
       - name: "Checkout"

ql/hotspots/requirements.in

@@ -0,0 +1,5 @@
+pyyaml
+pandas
+Jinja2
+beautifulsoup4
+PyGithub