Merge pull request #72 from crazy-max/gha-perms

ci: set contents read as default workflow permissions

Author: crazy-max

.github/workflows/build.yml

@@ -4,6 +4,10 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+ contents: read
+
 on:
  push:
  branches:
@@ -23,6 +27,11 @@ env:
 jobs:
  build:
  runs-on: ubuntu-latest
+ permissions:
+ # same as global permissions
+ contents: read
+ # required to push to GHCR
+ packages: write
  steps:
  -
  name: Checkout

.github/workflows/labels.yml

@@ -4,6 +4,10 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+ contents: read
+
 on:
  push:
  branches:
@@ -19,6 +23,11 @@ on:
 jobs:
  labeler:
  runs-on: ubuntu-latest
+ permissions:
+ # same as global permissions
+ contents: read
+ # required to update labels
+ issues: write
  steps:
  -
  name: Checkout

.github/workflows/test.yml

@@ -4,6 +4,10 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+ contents: read
+
 on:
  push:
  branches: