Add security documentation and minimal permissions to workflow examples

[Copilot]

This PR improves the security posture of the varlock-action by adding comprehensive security documentation and implementing minimal permissions across all workflow examples.

Changes Made

README.md Security Enhancements

New "Required Workflow Permissions" Section

• Added detailed explanation of why permission restriction is important
• Recommends permissions: contents: read for principle of least privilege
• Explains security benefits, compliance considerations, and audit trail improvements
• Clarifies GitHub's default broad permissions behavior

Updated All Workflow Examples
All 5 workflow examples now include the recommended permissions block:

permissions:
  contents: read

Enhanced Security Features Documentation

• Expanded security features section with GitHub Actions-specific measures
• Added comprehensive security best practices subsection covering:
  • Minimal permissions usage
  • Sensitive data handling guidelines
  • Proper @sensitive decorator usage
  • Secret rotation recommendations
  • Environment isolation practices

JSON Output Security Warning
Added prominent security warning for the JSON output format:

# Security Warning: json-env output may contain sensitive data
# Avoid logging the entire JSON blob

example-workflow.yml Security Updates

• Added top-level permissions: contents: read block
• Added job-level permissions for both test-with-varlock and deploy-production jobs
• Maintains all existing functionality while following security best practices

Security Impact

These changes significantly improve the security guidance for users by:

1. Reducing Attack Surface: Minimal permissions limit potential damage if workflows are compromised
2. Preventing Accidental Data Exposure: Clear warnings about JSON output handling
3. Following Industry Standards: Implements GitHub's recommended security practices
4. Maintaining Functionality: All existing features work unchanged

The action itself only requires read access to repository contents, making contents: read the appropriate minimal permission level for all use cases.

Validation

• ✅ All existing tests continue to pass
• ✅ Build process unchanged and successful
• ✅ No breaking changes to the action's functionality
• ✅ Security recommendations align with GitHub Actions best practices

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• ph.varlock.dev
  • Triggering command: node /home/REDACTED/work/varlock-action/varlock-action/node_modules/.bin/varlock --version (dns block)
  • Triggering command: node /home/REDACTED/work/varlock-action/varlock-action/node_modules/.bin/varlock load --format json-full (dns block)
  • Triggering command: node /home/REDACTED/work/varlock-action/varlock-action/node_modules/.bin/varlock load (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

This pull request was created as a result of the following prompt from Copilot chat.

Update the dmno-dev/varlock-action repository to improve security documentation and workflow examples:

1. Update README.md:

• Add a new section "Required Workflow Permissions" explaining why and how to restrict permission scopes, recommending permissions: contents: read.
• Update all workflow code examples to include the recommended permissions: block.
• Ensure warnings and secure usage instructions are clear, especially regarding secrets and json-env output.

2. Update example-workflow.yml:

• Add a top-level permissions: block with contents: read.
• Ensure all job-level examples use the same permissions block for least privilege.

The changes should improve user guidance for secure usage of the action and minimize permission risks.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.