ci: scope down GitHub Token permissions

.github/workflows/cd-pypi.yaml

@@ -4,6 +4,9 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest

.github/workflows/cd-release.yaml

@@ -4,6 +4,9 @@ on:
     tags:
       - "v1*"
 
+permissions:
+  contents: write
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/ci-branch.yaml

@@ -2,6 +2,9 @@ name: "[CI] Test branch"
 
 on: [push]
 
+permissions:
+  contents: read
+
 jobs:
   unitlint:
     if: github.repository == 'aws-cloudformation/cfn-lint' && github.ref_name == 'main'

.github/workflows/ci-pr-data.yaml

@@ -5,6 +5,9 @@ on:
     paths:
     - "src/cfnlint/data/**"
 
+permissions:
+  contents: read
+
 jobs:
   data:
     runs-on: ubuntu-latest

.github/workflows/ci-pr.yaml

@@ -2,6 +2,9 @@ name: "[CI] Test PR"
 
 on: [pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   unitlint:
     runs-on: ${{ matrix.os }}

.github/workflows/maintenance-v1.yaml

@@ -3,6 +3,10 @@ on:
   schedule:
     - cron: "0 8,20 * * *"
   workflow_dispatch: # Enables on-demand/manual triggering: https://docs.github.com/en/free-pro-team@latest/actions/managing-workflow-runs/manually-running-a-workflow
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   job:
     runs-on: ubuntu-latest