fix: token permissions (#1836)

Co-authored-by: Ivan Santos <[email protected]>

Author: maxday

.github/workflows/publish-layer-collector.yml

@@ -48,6 +48,9 @@ on:
         required: false
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   prepare-build-jobs:
     runs-on: ubuntu-latest

.github/workflows/release-layer-collector.yml

@@ -8,10 +8,12 @@ on:
 
 permissions:
   id-token: write
-  contents: write
+  contents: read
 
 jobs:
   create-release:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -20,6 +22,8 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   build-layer:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     needs: create-release
     strategy:

.github/workflows/release-layer-java.yml

@@ -8,10 +8,12 @@ on:
 
 permissions:
   id-token: write
-  contents: write
+  contents: read
 
 jobs:
   create-release:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -20,6 +22,8 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   build-layer:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     needs: create-release
     outputs:

.github/workflows/release-layer-nodejs.yml

@@ -8,10 +8,12 @@ on:
 
 permissions:
   id-token: write
-  contents: write
+  contents: read
 
 jobs:
   create-release:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -20,6 +22,8 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   build-layer:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     needs: create-release
     outputs:

.github/workflows/release-layer-python.yml

@@ -8,10 +8,12 @@ on:
 
 permissions:
   id-token: write
-  contents: write
+  contents: read
 
 jobs:
   create-release:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -20,6 +22,8 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   build-layer:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     needs: create-release
     outputs:

.github/workflows/release-layer-ruby.yml

@@ -8,10 +8,12 @@ on:
 
 permissions:
   id-token: write
-  contents: write
+  contents: read
 
 jobs:
   create-release:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -20,6 +22,8 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   build-layer:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     needs: create-release
     outputs: