ci: Harden GitHub Actions

.github/workflows/benchmark.yml

@@ -13,8 +13,7 @@ on:
     branches:
       - main
 name: benchmark pull requests
-permissions:
-  contents: read
+permissions: read-all
 
 jobs:
   runBenchmark:

.github/workflows/ci.yml

@@ -1,6 +1,7 @@
 name: CI
 env:
   CI: true
+permissions: read-all
 on:
   pull_request:
   push:

.github/workflows/fossa.yml

@@ -5,8 +5,7 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
+permissions: read-all
 
 jobs:
   fossa:

.github/workflows/integration_tests.yml

@@ -5,6 +5,8 @@ on:
   pull_request:
     types: [ labeled, synchronize, opened, reopened ]
 
+permissions: read-all
+
 jobs:
   integration_tests:
     runs-on: ubuntu-latest

.github/workflows/markdown-link-check.yml

@@ -8,8 +8,7 @@ on:
     paths:
       - '**/*.md'
 
-permissions:
-  contents: read
+permissions: read-all
 
 jobs:
   markdown-link-check:

.github/workflows/pr_naming.yml

@@ -4,6 +4,8 @@ on:
   pull_request:
     types: [opened, synchronize, reopened, edited]
 
+permissions: read-all
+
 jobs:
   validate-pr-title:
     runs-on: ubuntu-latest

.github/workflows/semver.yml

@@ -1,6 +1,7 @@
 name: Semver compliance
 env:
   CI: true
+permissions: read-all
 on:
   pull_request:
     types: [ labeled, synchronize, opened, reopened ]