security: scorecard sweep — fix #182/#173, dismiss #8/#175/#179/#180/#181

.clusterfuzzlite/Dockerfile

@@ -1,4 +1,4 @@
-FROM gcr.io/oss-fuzz-base/base-builder-python
+FROM gcr.io/oss-fuzz-base/base-builder-python@sha256:e24e8e50612617101dd10038502f68268ab45f31d79a3722c230464277a951b3
 
 # Install minimal build deps
 RUN apt-get update && apt-get install -y --no-install-recommends \

.github/workflows/paper-review.yml

@@ -29,9 +29,7 @@ on:
         default: "10"
 
 permissions:
-  contents: write       # to commit state.json + pending stubs
-  issues: write         # to file the daily summary issue
-  pull-requests: write  # so the bot can open a PR with the new pending files
+  contents: read
 
 concurrency:
   group: paper-review
@@ -41,6 +39,10 @@ jobs:
   review:
     name: Review 10 papers and file pending candidates
     runs-on: ubuntu-latest
+    permissions:
+      contents: write       # commit state.json + pending stubs to bot branch
+      issues: write         # file daily summary issue
+      pull-requests: write  # open bot PR with new pending files
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4