fix(ci): allow read-only reusable workflow callers

.github/workflows/__test-workflow-continuous-integration.yml

@@ -11,10 +11,7 @@ jobs:
     uses: $/.github/workflows/continuous-integration.yml
     permissions:
       contents: read
-      id-token: write
       packages: read
-      pull-requests: write
-      security-events: write
     with:
       working-directory: tests/continuous-integration
       build: ""
@@ -28,10 +25,7 @@ jobs:
     uses: $/.github/workflows/continuous-integration.yml
     permissions:
       contents: read
-      id-token: write
       packages: read
-      pull-requests: write
-      security-events: write
     with:
       checks: false
       container: invalid.example.invalid/must-not-be-pulled:latest
@@ -55,10 +49,7 @@ jobs:
     uses: $/.github/workflows/continuous-integration.yml
     permissions:
       contents: read
-      id-token: write
       packages: read
-      pull-requests: write
-      security-events: write
     with:
       working-directory: tests/source-package
       build: ""
@@ -354,10 +345,7 @@ jobs:
     needs: arrange-with-container
     permissions:
       contents: read
-      id-token: write
       packages: read
-      pull-requests: write
-      security-events: write
     with:
       container: ${{ fromJSON(needs.arrange-with-container.outputs.built-images).ci-npm.images[0] }}
       working-directory: /usr/src/app/

.github/workflows/continuous-integration.md

@@ -3,7 +3,7 @@
 # GitHub Reusable Workflow: Node.js Continuous Integration
 
 <div align="center">
-  <img src="https://opengraph.githubassets.com/798861777139bae96adc7ee652339a4713d1b50ce3b11cfb3ce6c363f2339b53/hoverkraft-tech/ci-github-nodejs" width="60px" align="center" alt="Node.js Continuous Integration" />
+  <img src="https://opengraph.githubassets.com/7e9813f9e19bd5adf686a5ff854c41da9068e2fb45a0d01f3d74b94a77ffe027/hoverkraft-tech/ci-github-nodejs" width="60px" align="center" alt="Node.js Continuous Integration" />
 </div>
 
 ---
@@ -16,7 +16,6 @@
 [![License](https://img.shields.io/github/license/hoverkraft-tech/ci-github-nodejs)](http://choosealicense.com/licenses/mit/)
 [![Stars](https://img.shields.io/github/stars/hoverkraft-tech/ci-github-nodejs?style=social)](https://img.shields.io/github/stars/hoverkraft-tech/ci-github-nodejs?style=social)
 [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](https://github.com/hoverkraft-tech/ci-github-nodejs/blob/main/CONTRIBUTING.md)
-![GitHub Verified Creator](https://img.shields.io/badge/GitHub-Verified%20Creator-4493F8?logo=data:image/svg%2bxml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAxNiAxNiIgd2lkdGg9IjE2IiBoZWlnaHQ9IjE2IiBmaWxsPSJyZ2IoNjgsIDE0NywgMjQ4KSI+CiAgPHBhdGggZD0ibTkuNTg1LjUyLjkyOS42OGMuMTUzLjExMi4zMzEuMTg2LjUxOC4yMTVsMS4xMzguMTc1YTIuNjc4IDIuNjc4IDAgMCAxIDIuMjQgMi4yNGwuMTc0IDEuMTM5Yy4wMjkuMTg3LjEwMy4zNjUuMjE1LjUxOGwuNjguOTI4YTIuNjc3IDIuNjc3IDAgMCAxIDAgMy4xN2wtLjY4LjkyOGExLjE3NCAxLjE3NCAwIDAgMC0uMjE1LjUxOGwtLjE3NSAxLjEzOGEyLjY3OCAyLjY3OCAwIDAgMS0yLjI0MSAyLjI0MWwtMS4xMzguMTc1YTEuMTcgMS4xNyAwIDAgMC0uNTE4LjIxNWwtLjkyOC42OGEyLjY3NyAyLjY3NyAwIDAgMS0zLjE3IDBsLS45MjgtLjY4YTEuMTc0IDEuMTc0IDAgMCAwLS41MTgtLjIxNUwzLjgzIDE0LjQxYTIuNjc4IDIuNjc4IDAgMCAxLTIuMjQtMi4yNGwtLjE3NS0xLjEzOGExLjE3IDEuMTcgMCAwIDAtLjIxNS0uNTE4bC0uNjgtLjkyOGEyLjY3NyAyLjY3NyAwIDAgMSAwLTMuMTdsLjY4LS45MjhjLjExMi0uMTUzLjE4Ni0uMzMxLjIxNS0uNTE4bC4xNzUtMS4xNGEyLjY3OCAyLjY3OCAwIDAgMSAyLjI0LTIuMjRsMS4xMzktLjE3NWMuMTg3LS4wMjkuMzY1LS4xMDMuNTE4LS4yMTVsLjkyOC0uNjhhMi42NzcgMi42NzcgMCAwIDEgMy4xNyAwWk03LjMwMyAxLjcyOGwtLjkyNy42OGEyLjY3IDIuNjcgMCAwIDEtMS4xOC40ODlsLTEuMTM3LjE3NGExLjE3OSAxLjE3OSAwIDAgMC0uOTg3Ljk4N2wtLjE3NCAxLjEzNmEyLjY3NyAyLjY3NyAwIDAgMS0uNDg5IDEuMThsLS42OC45MjhhMS4xOCAxLjE4IDAgMCAwIDAgMS4zOTRsLjY4LjkyN2MuMjU2LjM0OC40MjQuNzUzLjQ4OSAxLjE4bC4xNzQgMS4xMzdjLjA3OC41MDkuNDc4LjkwOS45ODcuOTg3bDEuMTM2LjE3NGEyLjY3IDIuNjcgMCAwIDEgMS4xOC40ODlsLjkyOC42OGMuNDE0LjMwNS45NzkuMzA1IDEuMzk0IDBsLjkyNy0uNjhhMi42NyAyLjY3IDAgMCAxIDEuMTgtLjQ4OWwxLjEzNy0uMTc0YTEuMTggMS4xOCAwIDAgMCAuOTg3LS45ODdsLjE3NC0xLjEzNmEyLjY3IDIuNjcgMCAwIDEgLjQ4OS0xLjE4bC42OC0uOTI4YTEuMTc2IDEuMTc2IDAgMCAwIDAtMS4zOTRsLS42OC0uOTI3YTIuNjg2IDIuNjg2IDAgMCAxLS40ODktMS4xOGwtLjE3NC0xLjEzN2ExLjE3OSAxLjE3OSAwIDAgMC0uOTg3LS45ODdsLTEuMTM2LS4xNzRhMi42NzcgMi42NzcgMCAwIDEtMS4xOC0uNDg5bC0uOTI4LS42OGExLjE3NiAxLjE3NiAwIDAgMC0xLjM5NCAwWk0xMS4yOCA2Ljc4bC0zLjc1IDMuNzVhLjc1Ljc1IDAgMCAxLTEuMDYgMEw0LjcyIDguNzhhLjc1MS43NTEgMCAwIDEgLjAxOC0xLjA0Mi43NTEuNzUxIDAgMCAxIDEuMDQyLS4wMThMNyA4Ljk0bDMuMjItMy4yMmEuNzUxLjc1MSAwIDAgMSAxLjA0Mi4wMTguNzUxLjc1MSAwIDAgMSAuMDE4IDEuMDQyWiI+PC9wYXRoPgo8L3N2Zz4K)
 
 <!-- badges:end -->
 
@@ -35,13 +34,20 @@ Workflow to performs continuous integration steps against a Node.js project:
 - Build
 - Test
 
+Set permissions on the calling job for the enabled features. Build, lint and
+tests require contents: read and packages: read. CodeQL additionally requires
+security-events: write; Codecov requires id-token: write; GitHub coverage
+comments require pull-requests: write (unless using a separate github-token).
+Disable coverage reporting with test: '{"coverage":null}' for read-only tests.
+Test and CodeQL jobs inherit the caller's permissions; other jobs restrict
+their permissions explicitly. Grant only the scopes your selected checks need.
+The generated permission list below is the read-only baseline. Default checks
+also need security-events: write and pull-requests: write on the calling job.
+
 ### Permissions
 
 - **`contents`**: `read`
-- **`id-token`**: `write`
 - **`packages`**: `read`
-- **`pull-requests`**: `write`
-- **`security-events`**: `write`
 
 <!-- overview:end -->
 
@@ -61,10 +67,7 @@ jobs:
     uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@02a04ad25ceaacdf3b7200e45fb7fec07fadf4fa # 2.1.0
     permissions:
       contents: read
-      id-token: write
       packages: read
-      pull-requests: write
-      security-events: write
     secrets:
       # Secrets to be used during the build step.
       # Must be a multi-line env formatted string.

.github/workflows/continuous-integration.yml

@@ -4,6 +4,16 @@
 # - Linting
 # - Build
 # - Test
+#
+# Set permissions on the calling job for the enabled features. Build, lint and
+# tests require contents: read and packages: read. CodeQL additionally requires
+# security-events: write; Codecov requires id-token: write; GitHub coverage
+# comments require pull-requests: write (unless using a separate github-token).
+# Disable coverage reporting with test: '{"coverage":null}' for read-only tests.
+# Test and CodeQL jobs inherit the caller's permissions; other jobs restrict
+# their permissions explicitly. Grant only the scopes your selected checks need.
+# The generated permission list below is the read-only baseline. Default checks
+# also need security-events: write and pull-requests: write on the calling job.
 
 name: Node.js Continuous Integration
 
@@ -227,8 +237,7 @@ on:
         description: "ID of the build artifact) uploaded during the build step."
         value: ${{ jobs.build.outputs.artifact-id }}
 
-permissions: {}
-
+# Optional reporting permissions are supplied by the calling job.
 jobs:
   prepare:
     name: 📦 Prepare configuration
@@ -484,8 +493,7 @@ jobs:
   code-ql:
     name: 🛡️ CodeQL Analysis
     if: inputs.checks == true && inputs.code-ql != ''
-    permissions:
-      security-events: write
+    # Inherit the caller's permission grant when CodeQL is enabled.
     runs-on: *ci-runner
     steps:
       - uses: hoverkraft-tech/ci-github-common/actions/checkout@ce885f8dd6bf7191a79e3eebdf37bca805d40932 # 3.0.0
@@ -643,11 +651,7 @@ jobs:
     needs:
       - prepare
       - build
-    permissions:
-      contents: read
-      id-token: write # Required for Codecov uploads with OIDC authentication
-      packages: read
-      pull-requests: write
+    # Inherit the caller's reporting permissions; coverage can be disabled.
     steps:
       - uses: hoverkraft-tech/ci-github-common/actions/checkout@ce885f8dd6bf7191a79e3eebdf37bca805d40932 # 3.0.0
         if: inputs.container == ''