Merge pull request #407 from Automattic/pltfrm-1402-code-scanning-alerts-for-automatticcron-control-repository

ci: add permissions to workflows

Author: sjinks

.github/workflows/ci-grunt.yaml

@@ -8,21 +8,23 @@ concurrency:
   group: ci-grunt-${{ github.ref }}
   cancel-in-progress: true
 
-env:
-  NODE_VERSION: "18"
+permissions:
+  contents: read
 
 jobs:
   build:
     name: Run Grunt tasks
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Check out source code
         uses: actions/[email protected]
 
       - name: Set up Node.js environment
         uses: actions/[email protected]
         with:
-          node-version: ${{ env.NODE_VERSION }}
+          node-version: lts/*
           cache: npm
 
       - name: Install dependencies

.github/workflows/ci-php.yaml

@@ -8,10 +8,15 @@ concurrency:
   group: ci-php-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Run tests
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:

.github/workflows/phpcs.yaml

@@ -8,18 +8,23 @@ concurrency:
   group: csc-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   codestyle:
     name: Run code style check
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Check out source code
         uses: actions/[email protected]
 
       - name: Set up PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: 8.1
+          php-version: 8.3
 
       - name: Install PHP Dependencies
         uses: ramsey/[email protected]