Make workflows zizmor-happy and delete spam workflow

.github/workflows/archive.yml

@@ -5,6 +5,9 @@ on:
     - cron: '0 0 1 * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   archive:
     name: Archive EOL repositories

.github/workflows/ci.yml

@@ -11,6 +11,9 @@ on:
       - '**.py'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest

.github/workflows/close-job-failure-issues.yml

@@ -3,6 +3,9 @@ name: Close Flathubbot Failure Issues
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   close-issues:
     runs-on: ubuntu-latest

.github/workflows/external-data-checker.yml

@@ -9,6 +9,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: false
 
+permissions:
+  contents: read
+
 jobs:
   flathub-data-checker-global:
     runs-on: ubuntu-latest

.github/workflows/lock-spams.yml

@@ -1,50 +0,0 @@
-name: Close and lock spam issues and PRs
-
-# WARNING: Do NOT use org level secrets or checkout any code in this
-# workflow
-
-on:
-  issues:
-    types: [labeled]
-  pull_request:
-    types: [labeled]
-  pull_request_target:
-    types: [labeled]
-  workflow_dispatch:
-
-jobs:
-  spam_issues:
-    if: github.event.label.name == 'spam' && github.event.issue != null
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-    steps:
-      - name: Close the issue
-        run: gh issue close "$ISSUE_NUM" --reason "not planned"
-      - name: Lock the issue
-        run: |
-          if [ "$(gh api repos/"$GH_REPO"/issues/"$ISSUE_NUM" --jq '.locked')" = "false" ]; then
-            gh issue lock "$ISSUE_NUM" --reason "spam"
-          fi
-    env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      GH_REPO: ${{ github.repository }}
-      ISSUE_NUM: ${{ github.event.issue.number }}
-
-  spam_prs:
-    if: github.event.label.name == 'spam' && github.event.pull_request != null
-    runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write
-    steps:
-      - name: Close the PR
-        run: gh pr close "$PR_NUM"
-      - name: Lock the PR
-        run: |
-          if [ "$(gh api repos/"$GH_REPO"/issues/"$PR_NUM" --jq '.locked')" = "false" ]; then
-            gh pr lock "$PR_NUM" --reason "spam"
-          fi
-    env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      GH_REPO: ${{ github.repository }}
-      PR_NUM: ${{ github.event.pull_request.number }}

.github/workflows/pr-check.yml

@@ -58,7 +58,7 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GH_REPO: ${{ github.repository }}
         run: |
-          IFS=',' read -ra PR_NUMBERS <<< "${{ env.DRAFT_PR_LIST }}"
+          IFS=',' read -ra PR_NUMBERS <<< "$DRAFT_PR_LIST"
 
           if [ ${#PR_NUMBERS[@]} -eq 0 ] || [ -z "${PR_NUMBERS[0]}" ]; then
             echo "No PRs found, exiting."
@@ -72,7 +72,7 @@ jobs:
 
       - name: Validate PRs
         run: |
-          IFS=',' read -ra PR_NUMBERS <<< "${{ env.PR_LIST }}"
+          IFS=',' read -ra PR_NUMBERS <<< "$PR_LIST"
 
           if [ ${#PR_NUMBERS[@]} -eq 0 ] || [ -z "${PR_NUMBERS[0]}" ]; then
             echo "No PRs found, exiting."

.github/workflows/tag-quality-mod-issues.yml

@@ -5,6 +5,8 @@ on:
     types: [opened, labeled]
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   label:
     if: startsWith(github.event.issue.title, 'Quality guideline problems for') && github.event.issue.state != 'closed'