GitHub Actions Permission Scope Audit

Audit GitHub Actions workflow permission scope drift to enforce least-privilege token access.