chore: adjust gha permissions and remove unused workflows (#93)

adjust gha permissions and remove unused workflows

Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>

Author: frewilhelm

.github/workflows/actionlint.yaml

@@ -12,6 +12,9 @@ on:
         default: './**/*.y*ml ./**/*.go'
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   codespell:
     name: codespell

.github/workflows/actionlint.yml

@@ -9,6 +9,12 @@ on:
     paths:
       - safe-settings/**
       - .github/workflows/safe-settings.yml
+
+# safe-settings authenticates via the OCMBOT GitHub App (APP_ID/PRIVATE_KEY),
+# so GITHUB_TOKEN only needs read access for checkout.
+permissions:
+  contents: read
+
 jobs:
   safeSettingsSync:
     name: synchronize settings

.github/workflows/codespell.yml

@@ -18,13 +18,15 @@ on:
         default: 'lifecycle/stale'
         type: string
 
-permissions:
-  contents: read # only for delete-branch option we would need write
-  issues: write
-  pull-requests: write
+permissions: {}
+
 jobs:
   stale:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # only for delete-branch option we would need write
+      issues: write
+      pull-requests: write
     steps:
       - uses: actions/stale@v9
         with:

.github/workflows/markdown.yml

@@ -4,11 +4,13 @@ on:
     types:
       - opened
 
-permissions:
-  issues: write
+permissions: {}
+
 jobs:
   add-labels:
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
     steps:
       - name: Add default Labels to new issues
         uses: actions/github-script@v7