fix code scanning alerts

Author: joshgubler

.github/workflows/ci-app.yml

@@ -17,6 +17,8 @@ jobs:
     name: Test
     timeout-minutes: 3
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v5
 
@@ -45,6 +47,8 @@ jobs:
     name: Audit
     timeout-minutes: 3
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v5
 
@@ -63,6 +67,8 @@ jobs:
     name: Lint
     timeout-minutes: 3
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v5
 

.github/workflows/ci-iac.yml

@@ -17,6 +17,8 @@ jobs:
     name: Set Env Vars
     timeout-minutes: 1
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Set up DEV Environment Variables
         if: github.base_ref == 'dev'
@@ -72,6 +74,8 @@ jobs:
     name: Tofu Format
     timeout-minutes: 3
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v5
 

.github/workflows/deploy.yml

@@ -18,6 +18,8 @@ jobs:
     name: Set Env Vars
     timeout-minutes: 1
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Set up DEV Environment Variables
         if: github.ref == 'refs/heads/dev'