chore(ci): harden security ownership and workflow permissions (#2045)

* chore(security): expand protected automation owners

* chore(ci): default workflows to no token permissions

.github/CODEOWNERS

@@ -5,7 +5,10 @@
 # If you add overlapping rules below the secops block, include @openclaw/openclaw-secops
 # on those entries too or you can silently remove required secops review.
 # Security-sensitive code, config, workflows, and docs require secops review.
+/.github/actions/ @openclaw/openclaw-secops
+/.github/actionlint.yaml @openclaw/openclaw-secops
 /.github/codeql/ @openclaw/openclaw-secops
+/.github/dependabot.yml @openclaw/openclaw-secops
 /.github/workflows/ @openclaw/openclaw-secops
 /scripts/check-staged-secrets.mjs @openclaw/openclaw-secops
 /scripts/clawhub-cli-npm-publish.sh @openclaw/openclaw-secops

.github/workflows/clawhub-cli-npm-release.yml

@@ -21,6 +21,8 @@ concurrency:
   group: clawhub-cli-npm-release-${{ inputs.tag }}
   cancel-in-progress: false
 
+permissions: {}
+
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
   NODE_VERSION: "24.x"

.github/workflows/package-publish.yml

@@ -80,6 +80,8 @@ on:
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
+permissions: {}
+
 jobs:
   publish:
     runs-on: ubuntu-latest

.github/workflows/secret-scan.yml

@@ -6,6 +6,8 @@ on:
   pull_request:
     branches: [main, master]
 
+permissions: {}
+
 jobs:
   trufflehog:
     name: Scan for Verified Secrets

.github/workflows/update-convex-ai-files.yml

@@ -10,6 +10,8 @@ concurrency:
   group: update-convex-ai-files
   cancel-in-progress: false
 
+permissions: {}
+
 env:
   BUN_VERSION: "1.3.10"
   UPDATE_BRANCH: automation/update-convex-ai-files