[woksin]

Changed

• The dependency update workflow declares the token permissions it needs: read-only by default, with write access only for the two jobs that push update commits to main (Declare token permissions in the dependency update workflow #665)

[woksin]

Part of the Q-19 audit before the organization default workflow token switches to read. Samples' update-nuget and update-npm jobs push with .github/scripts/push-with-retry.sh using the default token, and no permissions block covered them; the job-YAML scan missed this because the push sits in a script.

Checks: actionlint clean. The workflow runs only on schedule and dispatch, so PR CI does not exercise it; the next nightly run (03:43 UTC) after merge does. The scopes match what the jobs get today under the repository's write default, so nothing changes until the org switch.