## GitHub workflows lack explicit least-privilege permissions blocks

**Component:** konflux-operator-tasks

GitHub workflows do not declare an explicit top-level `permissions:` block, so they inherit the default (often broader) token permissions rather than being scoped to least privilege.

### Remediation
Add `permissions: contents: read` at the top level of every workflow (and at the top of go-ci.yaml), then grant narrower write scopes only where required (e.g. `security-events: write` for SARIF upload).

---
*Source: Ex-Wing/Glasswing Konflux CI security assessment (Mythos), finding FIND-003*