fix: openssf scoreboard points

.github/workflows/ci.yaml

@@ -23,10 +23,7 @@ on:
         description: "Override the tag of the dir-ctl Docker image to use in the tests."
 
 permissions:
-  contents: write
-  packages: write
-  id-token: write
-  pull-requests: write
+  contents: read
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -87,6 +84,10 @@ jobs:
     name: Test
     needs:
       - changes
+    permissions:
+      id-token: write
+      contents: read
+      packages: read
     uses: ./.github/workflows/reusable-test-sdk.yaml
     with:
       dir_chart_version: ${{ inputs.dir_chart_version }}
@@ -97,6 +98,9 @@ jobs:
     if: ${{ startsWith(github.ref, 'refs/tags/') }}
     needs:
       - test
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/reusable-release-sdk.yaml
     secrets: inherit
 

.github/workflows/codeql.yml

@@ -14,6 +14,9 @@ on:
     - cron: "42 5 * * 6"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze
@@ -38,26 +41,18 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - name: Setup Python (uv)
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
-          python-version: "3.14"
-          cache: "pip"
+          version: "0.12.7"
+          enable-cache: true
 
       - name: Install Python dependencies
         shell: bash
         run: |
           echo "📦 Installing Python dependencies..."
-          # Install dependencies for Python SDK
-          if [ -f "pyproject.toml" ]; then
-            pip install -e . || echo "Failed to install Python SDK"
-          fi
-          # Install dependencies for examples
-          if [ -f "examples/requirements.txt" ]; then
-            cd examples
-            pip install -r requirements.txt || echo "Failed to install example requirements"
-            cd ..
-          fi
+          uv sync --all-packages
+          cd examples && uv sync --all-packages && cd ..
           echo "✅ Python dependencies installed"
 
       # Initializes the CodeQL tools for scanning.

.github/workflows/dependencies.yaml

@@ -5,6 +5,9 @@ on:
   schedule:
     - cron: "0 */6 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   renovate:
     name: Renovate Sync

Taskfile.yml

@@ -110,13 +110,23 @@ tasks:
       - "{{.UV_BIN}} sync --all-packages"
 
   lint:
-    desc: Lint Python SDK (ruff check + format check + mypy)
+    desc: Lint Python SDK (ruff check + format check + mypy + lockfile sync)
     deps:
       - task: deps:packages
     cmds:
       - "{{.UV_BIN}} run ruff check dir-sdk-python examples"
       - "{{.UV_BIN}} run ruff format --check dir-sdk-python examples"
       - "{{.UV_BIN}} run mypy dir-sdk-python examples"
+      - task: lock:check
+
+  lock:check:
+    desc: Verify uv.lock is in sync with pyproject.toml (SDK + examples)
+    internal: true
+    deps:
+      - task: deps:uv
+    cmds:
+      - "{{.UV_BIN}} lock --check"
+      - "cd examples && {{.UV_BIN}} lock --check"
 
   lint:fix:
     desc: Auto-fix Python lint and formatting (local dev)

renovate.json

@@ -63,7 +63,8 @@
   ],
   "osvVulnerabilityAlerts": true,
   "lockFileMaintenance": {
-    "enabled": true
+    "enabled": true,
+    "schedule": ["at any time"]
   },
   "packageRules": [
     {