Explicitly set top-level permissions to read-all

Author: marcphilipp

.github/workflows/close-inactive-issues.yml

@@ -3,6 +3,7 @@ on:
   schedule:
     - cron: "30 1 * * *"
   workflow_dispatch:
+permissions: read-all
 jobs:
   close-issues:
     runs-on: ubuntu-latest

.github/workflows/codeql-analysis.yml

@@ -13,6 +13,8 @@ on:
   schedule:
     - cron: '0 19 * * 3'
 
+permissions: read-all
+
 env:
   DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 

.github/workflows/cross-version.yml

@@ -11,6 +11,8 @@ on:
     branches:
       - '*'
 
+permissions: read-all
+
 env:
   DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 

.github/workflows/gradle-dependency-submission.yml

@@ -5,13 +5,14 @@ on:
     branches:
       - main
 
-permissions:
-  contents: write
+permissions: read-all
 
 jobs:
   dependency-submission:
     if: github.repository == 'junit-team/junit5'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
     - name: Check out repository
       uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4

.github/workflows/label-opened-issues.yml

@@ -3,6 +3,7 @@ on:
   issues:
     types:
       - opened
+permissions: read-all
 jobs:
   label_issues:
     runs-on: ubuntu-latest

.github/workflows/main.yml

@@ -9,6 +9,8 @@ on:
     branches:
       - '*'
 
+permissions: read-all
+
 env:
   DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 

.github/workflows/reproducible-build.yml

@@ -9,6 +9,8 @@ on:
     branches:
       - '*'
 
+permissions: read-all
+
 env:
   DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 

.github/workflows/unlabel-closed-issues.yml

@@ -3,6 +3,7 @@ on:
   issues:
     types:
       - closed
+permissions: read-all
 jobs:
   label_issues:
     runs-on: ubuntu-latest