fix(ci): add explicit top-level permissions to existing workflows

.github/linters/.jscpd.json

@@ -0,0 +1,13 @@
+{
+  "threshold": 10,
+  "reporters": ["consoleFull"],
+  "ignore": [
+    "**/node_modules/**",
+    "**/vendor/**",
+    "**/.terraform/**",
+    "**/.venv/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/assets/scss/framework/**"
+  ]
+}

.github/workflows/lint.yml

@@ -0,0 +1,20 @@
+name: Lint
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    permissions:
+      contents: read
+      statuses: write
+      pull-requests: write
+    uses: LukeEvansTech/shared-workflows/.github/workflows/super-linter.yml@57fff6deea8cdc1b42b62a16e72ce73df3b82f97 # v1
+    with:
+      soft-launch: false

.github/workflows/psreddit-deploy-docs.yml

@@ -23,12 +23,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.14"
           cache: "pip"
@@ -42,10 +43,10 @@ jobs:
           zensical build
 
       - name: Setup Pages
-        uses: actions/configure-pages@v6
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: ./docs/site
 
@@ -58,4 +59,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.github/workflows/psreddit-publish-module.yml

@@ -5,12 +5,17 @@ on:
     types: [published]
   workflow_dispatch: # Allows manual triggering of the workflow
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     runs-on: windows-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       # PowerShell Core is already pre-installed on GitHub-hosted runners
 
@@ -20,18 +25,18 @@ jobs:
           # Path to the module directory (where the .psd1 file is located)
           $ModulePath = "${{ github.workspace }}/src/PSReddit"
           Write-Host "Publishing from: $ModulePath"
-          
+
           # Verify the module path exists and contains a valid module
           if (-not (Test-Path $ModulePath)) {
             Write-Error "Module path not found: $ModulePath"
             exit 1
           }
-          
+
           if (-not (Test-Path "$ModulePath/PSReddit.psd1")) {
             Write-Error "Module manifest not found at $ModulePath/PSReddit.psd1"
             exit 1
           }
-          
+
           # Publish the module
           try {
             Publish-Module -Path $ModulePath -NuGetApiKey ${{ secrets.PSGALLERY_API_KEY }} -Repository PSGallery -Verbose

.github/workflows/psreddit-test-on-linux.yml

@@ -11,12 +11,15 @@ on:
     branches:
       - main
     paths-ignore:
-      - '**.md'
-      - 'docs/**'
+      - "**.md"
+      - "docs/**"
   pull_request:
     paths-ignore:
-      - '**.md'
-      - 'docs/**'
+      - "**.md"
+      - "docs/**"
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Run Tests
@@ -27,33 +30,35 @@ jobs:
     strategy:
       fail-fast: false
     steps:
-    - name: Check out repository
-      uses: actions/checkout@v6
-    - name: Display the path
-      shell: pwsh
-      run: echo ${env:PATH}
-    - name: Version Display
-      shell: pwsh
-      run: $PSVersionTable
-    # uncomment below to explore what modules/variables/env variables are available in the build image
-    # - name: Modules and Variables Display
-    #   shell: pwsh
-    #   run: Get-Module -ListAvailable; (Get-Variable).GetEnumerator() | Sort-Object Name | Out-String; (Get-ChildItem env:*).GetEnumerator() | Sort-Object Name | Out-String
-    - name: Bootstrap
-      shell: pwsh
-      run: ./actions_bootstrap.ps1
-    - name: Test and Build
-      shell: pwsh
-      run: Invoke-Build -File .\src\PSReddit.build.ps1
-    - name: Upload pester results
-      uses: actions/upload-artifact@v7
-      with:
-        name: pester-results
-        path: ./src/Artifacts/testOutput
-        if-no-files-found: warn
-    - name: Upload zip module archive build
-      uses: actions/upload-artifact@v7
-      with:
-        name: zip-archive
-        path: ./src/Archive
-        if-no-files-found: warn
+      - name: Check out repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Display the path
+        shell: pwsh
+        run: echo ${env:PATH}
+      - name: Version Display
+        shell: pwsh
+        run: $PSVersionTable
+      # uncomment below to explore what modules/variables/env variables are available in the build image
+      # - name: Modules and Variables Display
+      #   shell: pwsh
+      #   run: Get-Module -ListAvailable; (Get-Variable).GetEnumerator() | Sort-Object Name | Out-String; (Get-ChildItem env:*).GetEnumerator() | Sort-Object Name | Out-String
+      - name: Bootstrap
+        shell: pwsh
+        run: ./actions_bootstrap.ps1
+      - name: Test and Build
+        shell: pwsh
+        run: Invoke-Build -File .\src\PSReddit.build.ps1
+      - name: Upload pester results
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: pester-results
+          path: ./src/Artifacts/testOutput
+          if-no-files-found: warn
+      - name: Upload zip module archive build
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: zip-archive
+          path: ./src/Archive
+          if-no-files-found: warn

.github/workflows/psreddit-test-on-macos.yml

@@ -1,59 +1,64 @@
-# https://help.github.com/en/actions/automating-your-workflow-with-github-actions
-# https://help.github.com/en/actions/automating-your-workflow-with-github-actions/virtual-environments-for-github-hosted-runners
-# https://help.github.com/en/actions/automating-your-workflow-with-github-actions/software-installed-on-github-hosted-runners
-# https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#using-a-specific-shell
-# https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions
-# https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-powershell
-# https://github.com/actions/upload-artifact#where-does-the-upload-go
-name: "PSReddit - Test on macOS"
-on:
-  pull_request:
-    paths-ignore:
-      - "**.md"
-      - "docs/**"
-  push:
-    branches:
-      - main
-    paths-ignore:
-      - "**.md"
-      - "docs/**"
-jobs:
-  test:
-    name: Run Tests
-    runs-on: macOS-latest
-    env:
-      REDDIT_CLIENT_ID: ${{ secrets.REDDIT_CLIENT_ID }}
-      REDDIT_CLIENT_SECRET: ${{ secrets.REDDIT_CLIENT_SECRET }}
-    strategy:
-      fail-fast: false
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v6
-      - name: Display the path
-        shell: pwsh
-        run: echo ${env:PATH}
-      - name: Version Display
-        shell: pwsh
-        run: $PSVersionTable
-      # uncomment below to explore what modules/variables/env variables are available in the build image
-      # - name: Modules and Variables Display
-      #   shell: pwsh
-      #   run: Get-Module -ListAvailable; (Get-Variable).GetEnumerator() | Sort-Object Name | Out-String; (Get-ChildItem env:*).GetEnumerator() | Sort-Object Name | Out-String
-      - name: Bootstrap
-        shell: pwsh
-        run: ./actions_bootstrap.ps1
-      - name: Test and Build
-        shell: pwsh
-        run: Invoke-Build -File .\src\PSReddit.build.ps1
-      - name: Upload pester results
-        uses: actions/upload-artifact@v7
-        with:
-          name: pester-results
-          path: ./src/Artifacts/testOutput
-          if-no-files-found: warn
-      - name: Upload zip module archive build
-        uses: actions/upload-artifact@v7
-        with:
-          name: zip-archive
-          path: ./src/Archive
-          if-no-files-found: warn
+# https://help.github.com/en/actions/automating-your-workflow-with-github-actions
+# https://help.github.com/en/actions/automating-your-workflow-with-github-actions/virtual-environments-for-github-hosted-runners
+# https://help.github.com/en/actions/automating-your-workflow-with-github-actions/software-installed-on-github-hosted-runners
+# https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#using-a-specific-shell
+# https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions
+# https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-powershell
+# https://github.com/actions/upload-artifact#where-does-the-upload-go
+name: "PSReddit - Test on macOS"
+on:
+  pull_request:
+    paths-ignore:
+      - "**.md"
+      - "docs/**"
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - "**.md"
+      - "docs/**"
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Run Tests
+    runs-on: macOS-latest
+    env:
+      REDDIT_CLIENT_ID: ${{ secrets.REDDIT_CLIENT_ID }}
+      REDDIT_CLIENT_SECRET: ${{ secrets.REDDIT_CLIENT_SECRET }}
+    strategy:
+      fail-fast: false
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Display the path
+        shell: pwsh
+        run: echo ${env:PATH}
+      - name: Version Display
+        shell: pwsh
+        run: $PSVersionTable
+      # uncomment below to explore what modules/variables/env variables are available in the build image
+      # - name: Modules and Variables Display
+      #   shell: pwsh
+      #   run: Get-Module -ListAvailable; (Get-Variable).GetEnumerator() | Sort-Object Name | Out-String; (Get-ChildItem env:*).GetEnumerator() | Sort-Object Name | Out-String
+      - name: Bootstrap
+        shell: pwsh
+        run: ./actions_bootstrap.ps1
+      - name: Test and Build
+        shell: pwsh
+        run: Invoke-Build -File .\src\PSReddit.build.ps1
+      - name: Upload pester results
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: pester-results
+          path: ./src/Artifacts/testOutput
+          if-no-files-found: warn
+      - name: Upload zip module archive build
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: zip-archive
+          path: ./src/Archive
+          if-no-files-found: warn