Code scan fix 54

.github/workflows/artifact-release-trigger.yml

@@ -0,0 +1,12 @@
+name: Trigger Artifact Release
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  actions: write
+
+jobs:
+  trigger:
+    uses: opentofu/scripts/.github/workflows/trigger.yml@main

.github/workflows/artifact-release.yml

@@ -0,0 +1,33 @@
+name: Artifact Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag (v#.#.#)"
+        type: string
+        required: true
+
+permissions:
+  contents: write
+
+jobs:
+  release-dispatch:
+    if: inputs.tag != ''
+    uses: opentofu/scripts/.github/workflows/release.yml@main
+    with:
+      tag: ${{ inputs.tag }}
+    secrets:
+      GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+      GH_PAT: ${{ secrets.GH_PAT }}
+      GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+
+  release-push:
+    if: inputs.tag == ''
+    uses: opentofu/scripts/.github/workflows/release.yml@main
+    with:
+      tag: ${{ github.ref_name }}
+    secrets:
+      GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+      GH_PAT: ${{ secrets.GH_PAT }}
+      GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}

.github/workflows/fork_sync.yml

@@ -0,0 +1,11 @@
+name: Sync Fork
+
+on:
+  schedule:
+    - cron: '15 */4 * * *' # every 4 hours
+  workflow_dispatch: # on button click
+
+jobs:
+  sync:
+    uses: opentofu/scripts/.github/workflows/sync.yml@main
+    secrets: inherit

.github/workflows/resign.yml

@@ -0,0 +1,17 @@
+name: Artifacts Resign
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  resign:
+    uses: opentofu/scripts/.github/workflows/sign.yml@main
+    with:
+      owner: ${{ github.repository_owner }}
+      repo: ${{ github.event.repository.name }}
+    secrets:
+      GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+      GH_PAT: ${{ secrets.GH_PAT }}

.github/workflows/stale.yml

@@ -2,6 +2,9 @@ name: "Stale issues and pull requests"
 on:
   schedule:
     - cron: "40 17 * * *"
+permissions:
+  contents: read
+  pull-requests: write    
 
 jobs:
   stale: