fix: harden security workflows

.github/workflows/dependabot-auto-merge.yml

@@ -16,26 +16,23 @@ on:
     types: [opened, synchronize, reopened]
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref }}
   cancel-in-progress: true
 
 jobs:
   dependabot-auto:
+    if: github.actor == 'dependabot[bot]'
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
-      # Dependabot 以外の場合はスキップ（Pass で終了）
-      - name: Skip non-Dependabot PRs
-        if: github.actor != 'dependabot[bot]'
-        run: echo "Not a Dependabot PR — skipping auto-merge."
-
       # 更新種別を取得（patch / minor / major）
       - name: Fetch Dependabot metadata
-        if: github.actor == 'dependabot[bot]'
         id: metadata
         uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
         with:

.github/workflows/security.yml

@@ -82,9 +82,9 @@ jobs:
 
       - name: Run npm audit
         run: npm audit --audit-level=critical
-        continue-on-error: true
 
       - name: Generate audit report
+        if: always()
         run: |
           echo "## NPM Audit Report" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY

.github/workflows/update-dev-tools.yml

@@ -11,13 +11,15 @@ concurrency:
   cancel-in-progress: false
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   check-updates:
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    permissions:
+      contents: write
+      pull-requests: write
     outputs:
       has_updates: ${{ steps.compare.outputs.has_updates }}
       updates_summary: ${{ steps.compare.outputs.summary }}

.github/workflows/update-libraries.yml

@@ -10,8 +10,7 @@ concurrency:
   cancel-in-progress: false
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 # npm devDependencies, GitHub Actions, and Docker base images are owned by Dependabot
 # (.github/dependabot.yml). This workflow only refreshes npm/global.json, which Dependabot
@@ -21,6 +20,9 @@ jobs:
   update:
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6