ci: add least-privilege workflow permissions

Grant each workflow only the permissions required by its actions and preserve the public signer API under the current RuboCop rules.

Author: peter-matkovski

.github/workflows/ci.yml

@@ -6,6 +6,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/initiate_release.yml

@@ -7,6 +7,10 @@ on:
         description: "The new version number with 'v' prefix. Example: v1.40.1"
         required: true
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   init_release:
     name: 🚀 Create release PR

.github/workflows/release.yml

@@ -7,6 +7,9 @@ on:
       - master
       - main
 
+permissions:
+  contents: write
+
 jobs:
   Release:
     name: 🚀 Release
@@ -37,4 +40,4 @@ jobs:
         with:
           body: ${{ env.CHANGELOG }}
           tag: ${{ env.VERSION }}
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/reviewdog.yml

@@ -6,6 +6,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   rubocop:
     name: 🐶 Reviewdog
@@ -22,4 +26,4 @@ jobs:
         uses: reviewdog/action-rubocop@v2
         with:
           rubocop_version: gemfile
-          reporter: github-pr-review
+          reporter: github-pr-review

.rubocop.yml

@@ -42,6 +42,8 @@ Style/DoubleCopDisableDirective:
   Enabled: false
 Style/FrozenStringLiteralComment:
   Enabled: false
+Style/OptionalArguments:
+  Enabled: false
 
 Gemspec/RequireMFA:
   Enabled: false