Fixed some Scorecard issues (#68)

Author: adimoft

.github/workflows/post-merge-scorecard.yml

@@ -16,10 +16,11 @@ permissions:
 jobs:
   call-scorecard:
     permissions:
-      contents: read
-      security-events: write
+      security-events: write   # required for SARIF upload
       id-token: write
-    uses: open-edge-platform/orch-ci/.github/workflows/post-merge-scorecard.yml@main
+      contents: read
+
+    uses: open-edge-platform/orch-ci/.github/workflows/post-merge-scorecard.yml@490a8651344e504bba68a208b1104254046dacd5  # v0.1.65
     with:
       project_folder: "."
     secrets:

.github/workflows/post-merge.yml

@@ -10,7 +10,8 @@ on:
       - release-*
   workflow_dispatch:
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   post-merge-pipeline:

.github/workflows/pre-merge.yml

@@ -10,7 +10,8 @@ on:
       - release-*
   workflow_dispatch:
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   pre-merge-pipeline: