Add minimum token permissions to all GitHub workflow files

Co-authored-by: trask <[email protected]>

Author: Copilot

.github/workflows/boost_log.yml

@@ -13,6 +13,9 @@ on:
       - 'instrumentation/boost_log/**'
       - '.github/workflows/boost_log.yml'
 
+permissions:
+  contents: read
+
 jobs:
   cmake_linux:
     name: CMake Linux

.github/workflows/fluentd.yml

@@ -13,8 +13,11 @@ on:
     branches: [main]
     paths:
       - "exporters/fluentd/**"
-      - ".github/workflows/fluentd.yml"
-
+      - ".github/workflows/fluentd.yml"
+
+permissions:
+  contents: read
+
 jobs:
   cmake_linux:
     name: CMake Linux

.github/workflows/geneva_metrics.yml

@@ -10,7 +10,11 @@ on:
     branches: [main]
     paths:
       - "exporters/geneva/**"
-      - ".github/workflows/geneva_metrics.yml"
+      - ".github/workflows/geneva_metrics.yml"
+
+permissions:
+  contents: read
+
 jobs:
   cmake_linux:
     name: CMake on Linux

.github/workflows/geneva_trace.yml

@@ -15,6 +15,9 @@ on:
       - "exporters/geneva-trace/**"
       - ".github/workflows/geneva_trace.yml"
 
+permissions:
+  contents: read
+
 jobs:
   geneva-trace-nuget-generation:
     name: Geneva Trace

.github/workflows/glog.yml

@@ -13,6 +13,9 @@ on:
       - 'instrumentation/glog/**'
       - '.github/workflows/glog.yml'
 
+permissions:
+  contents: read
+
 jobs:
   cmake_linux:
     name: CMake Linux

.github/workflows/httpd.yml

@@ -12,6 +12,9 @@ on:
       - 'instrumentation/httpd/**'
       - '.github/workflows/httpd.yml'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build module

.github/workflows/log4cxx.yml

@@ -13,6 +13,9 @@ on:
       - 'instrumentation/log4cxx/**'
       - '.github/workflows/log4cxx.yml'
 
+permissions:
+  contents: read
+
 jobs:
   cmake_linux:
     name: CMake Linux

.github/workflows/nginx.yml

@@ -14,17 +14,25 @@ on:
     paths:
       - 'instrumentation/nginx/**'
       - '.github/workflows/nginx.yml'
+
+permissions:
+  contents: read
+
 jobs:
   create-release:
     if: startsWith(github.ref, 'refs/tags/nginx')
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Release
         uses: softprops/action-gh-release@v2
   upload-release-artifacts:
     if: startsWith(github.ref, 'refs/tags/nginx')
     runs-on: ubuntu-latest
     needs: [nginx-build-test, create-release]
+    permissions:
+      contents: write
     steps:
       - name: Create directory
         run: |

.github/workflows/prometheus.yml

@@ -12,6 +12,9 @@ on:
       - "exporters/prometheus/**"
       - ".github/workflows/prometheus.yml"
 
+permissions:
+  contents: read
+
 jobs:
   prometheus_bazel_linux:
     name: Bazel on Linux

.github/workflows/spdlog.yml

@@ -13,6 +13,9 @@ on:
       - 'instrumentation/spdlog/**'
       - '.github/workflows/spdlog.yml'
 
+permissions:
+  contents: read
+
 jobs:
   cmake_linux:
     name: CMake Linux