ci: set permissions in workflows for codeql

.github/workflows/build-docker-meta.yml

@@ -13,6 +13,9 @@ on:
         required: true
         default: true
 
+permissions:
+  contents: read
+
 jobs:
   build-docker:
     runs-on: ubuntu-latest

.github/workflows/docker.yml

@@ -13,6 +13,10 @@ on:
       - "docker/**"
   workflow_dispatch:
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   generate-matrix:
     runs-on: ubuntu-latest

.github/workflows/docs-mkdocs.yml

@@ -13,6 +13,11 @@ on:
       - .github/workflows/docs-mkdocs.yml
       - mkdocs.yml
 
+permissions:
+  contents: write
+  pull-requests: write
+  pages: write
+
 jobs:
   mkdocs:
     runs-on: ubuntu-latest

.github/workflows/draft-release.yml

@@ -12,6 +12,11 @@ on:
         type: string
         default: ""
 
+permissions:
+  contents: write
+  pull-requests: write
+  issues: write
+
 jobs:
   draft-release:
     runs-on: ubuntu-latest

.github/workflows/main.yaml

@@ -9,6 +9,10 @@ on:
   pull_request:
     branches-ignore: []
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   dryrun-lint:
     runs-on: ubuntu-latest

.github/workflows/post-release.yml

@@ -5,6 +5,11 @@ on:
     types:
       - published
 
+permissions:
+  contents: write
+  pull-requests: write
+  issues: write
+
 jobs:
   cleanup:
     runs-on: ubuntu-latest

.github/workflows/techdev-project.yml

@@ -8,6 +8,9 @@ on:
     types:
       - opened
 
+permissions:
+  issues: read
+
 jobs:
   add-to-project:
     runs-on: ubuntu-latest

.github/workflows/user-projects.yml

@@ -8,6 +8,11 @@ on:
     types:
       - assigned
 
+permissions:
+  issues: read
+  pull-requests: read
+  contents: read
+
 jobs:
   add-to-project:
     uses: CCBR/.github/.github/workflows/auto-add-user-project.yml@v0.1.0