chore: add missing permissions to github workflows

Author: Julusian

.github/workflows/audit.yaml

@@ -4,6 +4,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   validate-prod-core-dependencies:
     name: Validate Core production dependencies

.github/workflows/node.yaml

@@ -9,6 +9,9 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   lint-core:
     name: Typecheck and Lint Core
@@ -103,6 +106,11 @@ jobs:
     name: Build Core and publish docker image
     runs-on: ubuntu-latest
     timeout-minutes: 30
+
+    permissions:
+      contents: read
+      packages: write
+      
     steps:
       - uses: actions/checkout@v6
         with:
@@ -283,6 +291,10 @@ jobs:
       matrix:
         gateway-name: [playout-gateway, mos-gateway, "live-status-gateway"]
 
+    permissions:
+      contents: read
+      packages: write
+
     steps:
       - uses: actions/checkout@v6
         with:
@@ -619,6 +631,9 @@ jobs:
     continue-on-error: true
     timeout-minutes: 15
 
+    permissions:
+      contents: write
+
     steps:
       - uses: actions/checkout@v6
         with:

.github/workflows/prune-container-images.yml

@@ -5,6 +5,10 @@ on:
   schedule:
     - cron: "12 14 * * *"
 
+permissions:
+  contents: read
+  packages: write
+  
 jobs:
   prune-container-images:
     if: ${{ github.repository_owner == 'Sofie-Automation' }}

.github/workflows/prune-tags.yml

@@ -14,6 +14,9 @@ on:
   schedule:
     - cron: "0 0 * * 0"
 
+permissions:
+  contents: write
+
 jobs:
   prune-tags:
     if: ${{ github.repository_owner == 'Sofie-Automation' }}

.github/workflows/sonar.yaml

@@ -9,6 +9,9 @@ on:
     types: [opened, synchronize, reopened]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 name: SonarCloud analysis
 jobs:
   sonarqube:

.github/workflows/trivy.yml

@@ -4,6 +4,10 @@ on:
   schedule:
     - cron: "0 10 * * 1"
 
+permissions:
+  contents: read
+  packages: read
+
 jobs:
   trivy:
     if: ${{ github.repository_owner == 'Sofie-Automation' }}