Develop

.github/workflows/app-api.yml

@@ -51,6 +51,9 @@ on:
         required: false
         default: 'false'
 
+permissions:
+  contents: read
+
 env:
   # Build and Deploy Configuration (non-sensitive, repository-level)
   CDK_REQUIRE_APPROVAL: never
@@ -128,6 +131,7 @@ jobs:
     name: Build Docker Image
     runs-on: ubuntu-24.04
     needs: [install, check-stack-dependencies]
+    if: github.event_name != 'pull_request'
 
     # Select environment to get project prefix for image naming
     environment: ${{ github.event.inputs.environment || (github.ref == 'refs/heads/main' && 'production') || (github.ref == 'refs/heads/develop' && 'development') || 'development' }}

.github/workflows/bootstrap-data-seeding.yml

@@ -1,5 +1,8 @@
 name: "6. Seed Bootstrap Data"
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
     inputs:

.github/workflows/codeql.yml

@@ -1,5 +1,8 @@
 name: "CodeQL Advanced"
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [ "develop" ]

.github/workflows/frontend.yml

@@ -45,10 +45,13 @@ on:
         required: false
         default: 'false'
 
+permissions:
+  contents: read
+
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
   # Build and Deploy Configuration (non-sensitive, repository-level)
-  BUILD_CONFIG: production
+  BUILD_CONFIG: ${{ github.event.inputs.environment || (github.ref == 'refs/heads/main' && 'production') || 'development' }}
   CDK_REQUIRE_APPROVAL: never
   WAIT_FOR_INVALIDATION: false
   # Suppress repeated config dumps from load-env.sh in CI logs
@@ -120,6 +123,7 @@ jobs:
     name: Build Frontend
     runs-on: ubuntu-24.04
     needs: [install, check-stack-dependencies]
+    if: github.event_name != 'pull_request'
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -152,6 +156,7 @@ jobs:
     name: Build CDK
     runs-on: ubuntu-24.04
     needs: [install, check-stack-dependencies]
+    if: github.event_name != 'pull_request'
     outputs:
       app-version: ${{ steps.read-version.outputs.APP_VERSION }}
     steps:

.github/workflows/gateway.yml

@@ -39,6 +39,9 @@ on:
         required: false
         default: 'false'
 
+permissions:
+  contents: read
+
 env:
   # Build and Deploy Configuration (non-sensitive, repository-level)
   CDK_REQUIRE_APPROVAL: never
@@ -55,6 +58,7 @@ jobs:
   check-stack-dependencies:
     name: Check Stack Dependencies
     runs-on: ubuntu-24.04
+    if: github.event_name != 'pull_request'
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -66,6 +70,7 @@ jobs:
   install:
     name: Install Dependencies
     runs-on: ubuntu-24.04
+    if: github.event_name != 'pull_request'
 
     # Select environment based on trigger
     # Manual: workflow_dispatch input
@@ -151,6 +156,7 @@ jobs:
     name: Synthesize CloudFormation
     runs-on: ubuntu-24.04
     needs: build-cdk
+    if: github.event_name != 'pull_request'
 
     # Select environment based on trigger
     # Manual: workflow_dispatch input

.github/workflows/inference-api.yml

@@ -49,6 +49,9 @@ on:
         required: false
         default: 'false'
 
+permissions:
+  contents: read
+
 env:
   # Build and Deploy Configuration (non-sensitive, repository-level)
   CDK_REQUIRE_APPROVAL: never
@@ -126,6 +129,7 @@ jobs:
     name: Build Docker Image
     runs-on: ubuntu-24.04-arm
     needs: [install, check-stack-dependencies]
+    if: github.event_name != 'pull_request'
 
     # Select environment to get project prefix for image naming
     environment: ${{ github.event.inputs.environment || (github.ref == 'refs/heads/main' && 'production') || (github.ref == 'refs/heads/develop' && 'development') || 'development' }}

.github/workflows/infrastructure.yml

@@ -47,6 +47,9 @@ on:
         required: false
         default: 'false'
 
+permissions:
+  contents: read
+
 env:
   # Build and Deploy Configuration (non-sensitive, repository-level)
   CDK_REQUIRE_APPROVAL: never
@@ -136,6 +139,7 @@ jobs:
     name: Synthesize CloudFormation Template
     runs-on: ubuntu-24.04
     needs: build
+    if: github.event_name != 'pull_request'
 
     # Select environment based on trigger
     # Manual: workflow_dispatch input

.github/workflows/nightly-deploy-pipeline.yml

@@ -35,6 +35,9 @@ on:
         default: ''
         type: string
 
+permissions:
+  contents: read
+
 env:
   CDK_REQUIRE_APPROVAL: never
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

.github/workflows/nightly.yml

@@ -47,6 +47,9 @@ on:
           - 'true'
           - 'false'
 
+permissions:
+  contents: read
+
 env:
   CDK_REQUIRE_APPROVAL: never
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

.github/workflows/rag-ingestion.yml

@@ -40,6 +40,9 @@ on:
         required: false
         default: 'false'
 
+permissions:
+  contents: read
+
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
   # Build and Deploy Configuration (non-sensitive, repository-level)
@@ -56,6 +59,7 @@ jobs:
   check-stack-dependencies:
     name: Check Stack Dependencies
     runs-on: ubuntu-24.04
+    if: github.event_name != 'pull_request'
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -67,6 +71,7 @@ jobs:
   install:
     name: Install Dependencies
     runs-on: ubuntu-24.04
+    if: github.event_name != 'pull_request'
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -99,6 +104,7 @@ jobs:
     name: Build Docker Image
     runs-on: ubuntu-24.04-arm  # Use ARM64-native runner for ARM64 Lambda builds
     needs: [install, check-stack-dependencies]
+    if: github.event_name != 'pull_request'
 
     # Select environment to get project prefix for image naming
     environment: ${{ github.event.inputs.environment || (github.ref == 'refs/heads/main' && 'production') || (github.ref == 'refs/heads/develop' && 'development') || 'development' }}

.github/workflows/release.yml

@@ -1,5 +1,8 @@
 name: "Release"
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/sagemaker-fine-tuning.yml

@@ -47,6 +47,9 @@ on:
         required: false
         default: 'false'
 
+permissions:
+  contents: read
+
 env:
   # Build and Deploy Configuration (non-sensitive, repository-level)
   CDK_REQUIRE_APPROVAL: never
@@ -63,6 +66,7 @@ jobs:
   check-stack-dependencies:
     name: Check Stack Dependencies
     runs-on: ubuntu-24.04
+    if: github.event_name != 'pull_request'
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -74,6 +78,7 @@ jobs:
   install:
     name: Install Dependencies
     runs-on: ubuntu-24.04
+    if: github.event_name != 'pull_request'
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -124,6 +129,7 @@ jobs:
     name: Synthesize CloudFormation Template
     runs-on: ubuntu-24.04
     needs: build
+    if: github.event_name != 'pull_request'
     outputs:
       enabled: ${{ steps.check.outputs.enabled }}
 

.github/workflows/version-check.yml

@@ -1,5 +1,8 @@
 name: "Version Check"
 
+permissions:
+  contents: read
+
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
   # Suppress repeated config dumps from load-env.sh in CI logs