Add GitHub Actions Permissions

Author: RehanSaeed

.github/workflows/build.yml

@@ -60,6 +60,8 @@ jobs:
     environment:
       name: 'GitHub Packages'
       url: https://github.com/RehanSaeed/Schema.NET/packages
+    permissions:
+      packages: write
     runs-on: windows-latest
     steps:
       - name: 'Download Artefact'

.github/workflows/codeql-analysis.yml

@@ -7,40 +7,34 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [master]
+    branches: [ main ]
   pull_request:
     # The branches below must be a subset of the branches above
-    branches: [master]
+    branches: [ main ]
   schedule:
     - cron: '0 7 * * 4'
   workflow_dispatch:
 
 jobs:
   analyze:
     name: Analyze
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
     runs-on: ubuntu-latest
 
     strategy:
       fail-fast: false
       matrix:
-        # Override automatic language detection by changing the below list
-        # Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
-        language: ['csharp']
-        # Learn more...
-        # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
+        language: [ 'csharp' ]
+        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
+        # Learn more:
+        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
 
     steps:
     - name: Checkout repository
       uses: actions/[email protected]
-      with:
-        # We must fetch at least the immediate parents so that if this is
-        # a pull request then we can checkout the head.
-        fetch-depth: 2
-
-    # If this run was triggered by a pull request event, then checkout
-    # the head of the pull request instead of the merge commit.
-    - run: git checkout HEAD^2
-      if: ${{ github.event_name == 'pull_request' }}
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/release-drafter.yml

@@ -8,6 +8,9 @@ on:
 
 jobs:
   update_release_draft:
+    permissions:
+      contents: write
+      pull-requests: read
     runs-on: ubuntu-latest
     steps:
       - uses: release-drafter/release-drafter@v5