chore(ci): update permissions (#1764)

Author: sthulb

.github/workflows/build-docs.yml

@@ -18,6 +18,9 @@ on:
       - 'mkdocs.yml'
       - 'Makefile'
 
+permissions:
+  contents: read
+
 jobs:
   docs:
     runs-on: ubuntu-latest

.github/workflows/dispatch_analytics.yml

@@ -7,22 +7,23 @@ on:
     - cron: '0 * * * *'
 
 permissions:
-  id-token: write
-  actions: read
-  checks: read
   contents: read
-  deployments: read
-  issues: read
-  discussions: read
-  packages: read
-  pages: read
-  pull-requests: read
-  repository-projects: read
-  security-events: read
-  statuses: read
 
 jobs:
   dispatch_token:
+    permissions:
+      id-token: write
+      actions: read
+      checks: read
+      deployments: read
+      issues: read
+      discussions: read
+      packages: read
+      pages: read
+      pull-requests: read
+      repository-projects: read
+      security-events: read
+      statuses: read
     concurrency:
       group: analytics
     runs-on: ubuntu-latest

.github/workflows/docs.yml

@@ -7,14 +7,14 @@ on:
   workflow_dispatch: {}
 
 permissions:
-  id-token: write
   contents: write
-  pages: write
 
 jobs:
   docs:
     runs-on: ubuntu-latest
     environment: Docs
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9  # v3.5.3
       - name: Set up Python

.github/workflows/pr_artifacts_size.yml

@@ -23,6 +23,10 @@ on:
       - 'powertools-validation/**'
       - 'pom.xml'
       - '.github/workflows/pr_artifacts_size.yml'
+
+permissions:
+  contents: read
+
 jobs:
   codecheck:
     runs-on: ubuntu-latest

.github/workflows/pr_build.yml

@@ -45,6 +45,10 @@ on:
       - 'pom.xml'
       - 'examples/pom.xml'
       - '.github/workflows/**'
+
+permissions:
+  contents: read
+
 jobs:
   build-corretto:
     runs-on: ubuntu-latest
@@ -58,7 +62,6 @@ jobs:
       AWS_REGION: eu-west-1
     permissions:
       id-token: write # needed to interact with GitHub's OIDC Token endpoint.
-      contents: read
     steps:
       - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9  # v3.5.3
       - name: Setup java

.github/workflows/pr_build_v2.yml

@@ -41,6 +41,10 @@ on:
       - 'pom.xml'
       - 'examples/pom.xml'
       - '.github/workflows/**'
+
+permissions:
+  contents: read
+
 jobs:
   build-corretto:
     runs-on: ubuntu-latest
@@ -54,7 +58,6 @@ jobs:
       AWS_REGION: eu-west-1
     permissions:
       id-token: write # needed to interact with GitHub's OIDC Token endpoint.
-      contents: read
     steps:
       - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9  # v3.5.3
       - name: Setup java

.github/workflows/pr_iac_lint.yml

@@ -11,6 +11,10 @@ on:
       - v2
     paths:
       - 'examples/**'
+
+permissions:
+  contents: read
+
 jobs:
   linter:
     runs-on: ubuntu-latest

.github/workflows/publish.yml

@@ -4,9 +4,15 @@ on:
     types:
       - published
   workflow_dispatch: {}
+
+permissions:
+  contents: read
+
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9  # v3.5.3
       - name: Set up Maven Central Repository

.github/workflows/release-drafter.yml

@@ -6,9 +6,14 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   update_release_draft:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
       - uses: release-drafter/release-drafter@569eb7ee3a85817ab916c8f8ff03a5bd96c9c83e # v5.23.0
         env:

.github/workflows/release-prep.yml

@@ -6,9 +6,14 @@ on:
         description: 'Release number to upgrade to. For example X.X.X. Follow Semantic Versioning when deciding on next version.'
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9  # v3.5.3
       - name: Get current date