fix: harden workflow token permissions and pin yamllint

.github/workflows/peribolos-apply.yml

@@ -19,6 +19,9 @@ on:
         type: boolean
         default: false
 
+permissions:
+  contents: read
+
 concurrency:
   group: peribolos-apply
   cancel-in-progress: false
@@ -32,6 +35,8 @@ jobs:
     steps:
       - name: Checkout complytime/.github repo
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
@@ -48,6 +53,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: kubernetes-sigs/prow
+          persist-credentials: false
 
       - name: Build peribolos
         if: >-

.github/workflows/peribolos-drift.yml

@@ -14,6 +14,9 @@ on:
     - cron: '30 4 * * 1'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   detect-drift:
     if: github.repository_owner == 'complytime'
@@ -25,6 +28,8 @@ jobs:
     steps:
       - name: Checkout complytime/.github repo
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
@@ -38,6 +43,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: kubernetes-sigs/prow
+          persist-credentials: false
 
       - name: Build peribolos
         run: |

.github/workflows/peribolos-validate.yml

@@ -6,13 +6,18 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   project:
     name: Verify peribolos
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: './go.mod'
@@ -27,4 +32,4 @@ jobs:
           go test ./...
 
       - name: Install yamllint and check peribolos.yaml
-        run: pip install yamllint && yamllint peribolos.yaml
+        run: pip install yamllint==1.38.0 && yamllint peribolos.yaml

.github/zizmor.yml

@@ -0,0 +1,11 @@
+# zizmor configuration — https://docs.zizmor.sh/configuration/
+#
+# Peribolos manages the entire complytime GitHub org (membership, teams,
+# repos), so its GitHub App token intentionally has org-wide scope.
+# The github-app audit flags this as dangerous, but scoping the token
+# to individual repositories would break peribolos' core functionality.
+rules:
+  github-app:
+    ignore:
+      - peribolos-apply.yml
+      - peribolos-drift.yml