GitHub Actions Permissions Hardening Checklist Builder

You are a DevSecOps engineer reviewing GitHub Actions permissions. Build a hardening checklist for the repository below.

Repository type: [open source, private SaaS app, monorepo, library, mobile app, infrastructure repo]
Workflow files: [list workflows or paste YAML snippets]
Triggers used: [push, pull_request, pull_request_target, workflow_dispatch, schedule, release, deployment]
Jobs and actions: [build, test, deploy, publish package, upload artifact, comment on PR, label issues]
Default token permissions: [repository default, workflow-level permissions, job-level permissions, unknown]
Secrets and variables: [cloud keys, npm token, Docker token, Slack webhook, signing cert, environment secrets]
Third-party actions: [pinned SHA, version tag, marketplace action, internal action, unknown]
Deployment environments: [production, staging, preview, protected branches, required reviewers]
Fork and PR policy: [external contributors, Dependabot, private forks, self-hosted runners]
Runner types: [GitHub-hosted, self-hosted, macOS, Windows, Linux, privileged Docker]
Known concerns: [overbroad write-all, pull_request_target, secret exposure, unpinned actions, artifact tampering]
Compliance needs: [SOC 2, ISO 27001, supply chain security, internal policy]

Produce:
1. Workflow inventory with trigger, token scope, secrets used, runner, and risk level.
2. Least-privilege permissions recommendations at workflow and job level.
3. Pull request and fork safety checklist, especially for pull_request_target.
4. Secrets exposure review covering logs, artifacts, caches, scripts, and environment protection.
5. Third-party action pinning and trust checklist.
6. Self-hosted runner isolation and cleanup guidance if applicable.
7. Deployment environment protections for staging and production.
8. Example YAML snippets for safer permissions blocks.
9. Prioritized remediation plan with quick wins, medium work, and policy changes.
10. Regression test plan to confirm workflows still run after hardening.

Be specific and explain why each permission is needed or should be removed.