chore: reconfigure permission model for Github actions MCP-279

[himanshusinghs]

Proposed changes

Modifies the Github workflows (Code Health and Code Health from fork) to work with least privileges and fixes the accidental problem where dependabot created PRs and forked PRs were not being tested for the modified dependencies and PR contents.

Additionally, we don't persist Git credentials when not required.

Checklist

• I have signed the MongoDB CLA

[Copilot]

Pull Request Overview

This PR reconfigures GitHub Actions permissions following the principle of least privilege and fixes an issue preventing Dependabot PRs from being tested. The changes grant minimal required permissions (contents: read) and disable credential persistence to improve security, while also re-enabling code health checks for both Dependabot and fork PRs.

Key Changes:

• Switched from empty permissions to explicit contents: read permission
• Added persist-credentials: false to all checkout actions for security hardening
• Changed code-health-fork.yml trigger from pull_request_target to pull_request and re-enabled fork PR testing

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/code-health.yml	Added explicit read permission and disabled credential persistence across all checkout steps
.github/workflows/code-health-fork.yml	Changed trigger event, updated permissions, re-enabled fork testing, and disabled credential persistence

[coveralls]

Pull Request Test Coverage Report for Build 19110567098

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage remained the same at 80.149%

---

Totals
Change from base Build 19074925294:	0.0%
Covered Lines:	6477
Relevant Lines:	7972

---

💛 - Coveralls

[fmenezes]

if we are changing this, do we need separated workflows for fork and non fork?

[himanshusinghs]

We already have separated workflows for both forks (code-health-fork.yml) and non-forks (code-health.yml). The problem earlier was that code-health-fork.yml was never testing the actual changes of the pull request because the workflow was triggered by pull_request_target trigger which was acting in the context of main branch and never checking out the pull request changes.

[nirinchev]

As an alternative, consider switching to v6-beta as that has a mitigation for the persist-credentials issue.

[himanshusinghs]

The release is only 3 days. I am thinking of letting it marinate a bit before pulling it in. Will keep on eye on it though. Thanks for the heads up.