Merge pull request #365 from per1234/github_token-permissions-config

Configure permissions of `GITHUB_TOKEN` in workflows

Author: per1234

.github/workflows/check-ci-sync.yml

@@ -27,6 +27,7 @@ on:
 jobs:
   check-sync:
     runs-on: ubuntu-latest
+    permissions: {}
 
     steps:
       - name: Checkout repository

.github/workflows/check-clang-format.yml

@@ -39,6 +39,7 @@ on:
 jobs:
   validate:
     runs-on: ubuntu-latest
+    permissions: {}
 
     steps:
       - name: Checkout repository
@@ -60,6 +61,7 @@ jobs:
 
   check-config:
     runs-on: ubuntu-latest
+    permissions: {}
 
     steps:
       - name: Checkout repository
@@ -136,6 +138,7 @@ jobs:
 
   check-output:
     runs-on: ubuntu-latest
+    permissions: {}
 
     steps:
       - name: Checkout repository
@@ -195,6 +198,7 @@ jobs:
 
   check-testdata:
     runs-on: ubuntu-latest
+    permissions: {}
 
     steps:
       - name: Checkout repository
@@ -211,6 +215,7 @@ jobs:
 
   convert:
     runs-on: ubuntu-latest
+    permissions: {}
 
     steps:
       - name: Set environment variables

.github/workflows/check-community-health-sync.yml

@@ -33,6 +33,7 @@ on:
 jobs:
   check-sync:
     runs-on: ubuntu-latest
+    permissions: {}
 
     steps:
       - name: Checkout repository

.github/workflows/check-config-sync.yml

@@ -19,6 +19,7 @@ on:
 jobs:
   check-sync:
     runs-on: ubuntu-latest
+    permissions: {}
 
     steps:
       - name: Checkout repository

.github/workflows/check-dependabot.yml

@@ -21,6 +21,7 @@ on:
 jobs:
   validate:
     runs-on: ubuntu-latest
+    permissions: {}
 
     steps:
       - name: Checkout repository

.github/workflows/check-eslint.yml

@@ -29,6 +29,7 @@ on:
 jobs:
   validate:
     runs-on: ubuntu-latest
+    permissions: {}
 
     steps:
       - name: Checkout repository

.github/workflows/check-files-task.yml

@@ -17,6 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       result: ${{ steps.determination.outputs.result }}
+    permissions: {}
     steps:
       - name: Determine if the rest of the workflow should run
         id: determination
@@ -40,6 +41,8 @@ jobs:
     needs: run-determination
     if: needs.run-determination.outputs.result == 'true'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout repository
@@ -58,6 +61,8 @@ jobs:
     needs: run-determination
     if: needs.run-determination.outputs.result == 'true'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout repository

.github/workflows/check-general-formatting-task.yml

@@ -15,6 +15,7 @@ on:
 jobs:
   run-determination:
     runs-on: ubuntu-latest
+    permissions: {}
     outputs:
       result: ${{ steps.determination.outputs.result }}
     steps:
@@ -40,6 +41,8 @@ jobs:
     needs: run-determination
     if: needs.run-determination.outputs.result == 'true'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Set environment variables

.github/workflows/check-issue-templates.yml

@@ -21,6 +21,7 @@ on:
 jobs:
   validate:
     runs-on: ubuntu-latest
+    permissions: {}
 
     steps:
       - name: Checkout repository

.github/workflows/check-javascript-task.yml

@@ -29,12 +29,10 @@ on:
   workflow_dispatch:
   repository_dispatch:
 
-permissions:
-  contents: read
-
 jobs:
   run-determination:
     runs-on: ubuntu-latest
+    permissions: {}
     outputs:
       result: ${{ steps.determination.outputs.result }}
     steps:
@@ -60,6 +58,8 @@ jobs:
     needs: run-determination
     if: needs.run-determination.outputs.result == 'true'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout repository