Add minimum token permissions for all GitHub workflow files

.github/workflows/boost_log.yml

@@ -13,6 +13,9 @@ on:
       - 'instrumentation/boost_log/**'
       - '.github/workflows/boost_log.yml'
 
+permissions:
+  contents: read
+
 jobs:
   cmake_linux:
     name: CMake Linux

.github/workflows/fluentd.yml

@@ -13,8 +13,11 @@ on:
     branches: [main]
     paths:
       - "exporters/fluentd/**"
-      - ".github/workflows/fluentd.yml"
-
+      - ".github/workflows/fluentd.yml"
+
+permissions:
+  contents: read
+
 jobs:
   cmake_linux:
     name: CMake Linux

.github/workflows/geneva_metrics.yml

@@ -8,9 +8,11 @@ on:
       - ".github/workflows/geneva_metrics.yml"
   pull_request:
     branches: [main]
-    paths:
-      - "exporters/geneva/**"
-      - ".github/workflows/geneva_metrics.yml"
+    paths:
+      - "exporters/geneva/**"
+      - ".github/workflows/geneva_metrics.yml"
+permissions:
+  contents: read
 jobs:
   cmake_linux:
     name: CMake on Linux

.github/workflows/geneva_trace.yml

@@ -15,6 +15,9 @@ on:
       - "exporters/geneva-trace/**"
       - ".github/workflows/geneva_trace.yml"
 
+permissions:
+  contents: read
+
 jobs:
   geneva-trace-nuget-generation:
     name: Geneva Trace

.github/workflows/glog.yml

@@ -13,6 +13,9 @@ on:
       - 'instrumentation/glog/**'
       - '.github/workflows/glog.yml'
 
+permissions:
+  contents: read
+
 jobs:
   cmake_linux:
     name: CMake Linux

.github/workflows/httpd.yml

@@ -12,6 +12,9 @@ on:
       - 'instrumentation/httpd/**'
       - '.github/workflows/httpd.yml'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build module

.github/workflows/log4cxx.yml

@@ -13,6 +13,9 @@ on:
       - 'instrumentation/log4cxx/**'
       - '.github/workflows/log4cxx.yml'
 
+permissions:
+  contents: read
+
 jobs:
   cmake_linux:
     name: CMake Linux

.github/workflows/nginx.yml

@@ -14,17 +14,23 @@ on:
     paths:
       - 'instrumentation/nginx/**'
       - '.github/workflows/nginx.yml'
+permissions:
+  contents: read
 jobs:
   create-release:
     if: startsWith(github.ref, 'refs/tags/nginx')
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Release
         uses: softprops/action-gh-release@v2
   upload-release-artifacts:
     if: startsWith(github.ref, 'refs/tags/nginx')
     runs-on: ubuntu-latest
     needs: [nginx-build-test, create-release]
+    permissions:
+      contents: write
     steps:
       - name: Create directory
         run: |

.github/workflows/prometheus.yml

@@ -12,6 +12,9 @@ on:
       - "exporters/prometheus/**"
       - ".github/workflows/prometheus.yml"
 
+permissions:
+  contents: read
+
 jobs:
   prometheus_bazel_linux:
     name: Bazel on Linux

.github/workflows/spdlog.yml

@@ -13,6 +13,9 @@ on:
       - 'instrumentation/spdlog/**'
       - '.github/workflows/spdlog.yml'
 
+permissions:
+  contents: read
+
 jobs:
   cmake_linux:
     name: CMake Linux

.github/workflows/user_events.yml

@@ -11,8 +11,11 @@ on:
     branches: [main]
     paths:
       - 'exporters/user_events/**'
-      - '.github/workflows/user_events.yml'
-
+      - '.github/workflows/user_events.yml'
+
+permissions:
+  contents: read
+
 jobs:
   cmake_linux:
     name: CMake Linux

.github/workflows/webserver.yml

@@ -12,6 +12,9 @@ on:
       - 'instrumentation/otel-webserver-module/**'
       - '.github/workflows/webserver.yml'
 
+permissions:
+  contents: read
+
 jobs:
   webserver-build-test-ubuntu:
     name: webserver-ubuntu-build