Harden default permissions of GH actions ( - Fixes #39 - )

Author: reactive-firewall

.github/workflows/Labeler.yml

@@ -4,6 +4,9 @@ on:
     types: [opened, reopened]
     branches: [ master, stable ]
 
+# Declare default permissions as none.
+permissions: none
+
 jobs:
   triage:
     permissions:

.github/workflows/Tests.yml

@@ -7,6 +7,9 @@ on:
     tags:
       - v*
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   BUILD:
     if: github.repository == 'reactive-firewall/python-repo'

.github/workflows/codeql-analysis.yml

@@ -20,6 +20,9 @@ on:
   schedule:
     - cron: '17 5 * * 1'
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   analyze:
     name: Analyze