Add explicit token permissions (#547)

Signed-off-by: Jose R. Gonzalez <[email protected]>

Author: komish

.github/workflows/build.yaml

@@ -8,6 +8,8 @@ jobs:
     unit-tests:
         name: Unit Tests
         runs-on: ubuntu-latest
+        permissions:
+          contents: read
 
         steps:
             - name: Checkout changes

.github/workflows/functional-tests.yaml

@@ -49,6 +49,8 @@ on:
 jobs:
   run-functional-tests:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout PR branch
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

.github/workflows/golang-style.yml

@@ -8,6 +8,8 @@ on:
 jobs:
   enforce:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - name: Checkout code
       uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

.github/workflows/main.yaml

@@ -15,6 +15,8 @@ jobs:
     image:
       name: Build and push container images
       runs-on: ubuntu-latest
+      permissions:
+        contents: read
       steps:
       - name: Checkout code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

.github/workflows/pr-functional-tests.yaml

@@ -53,6 +53,8 @@ jobs:
       target-sha: ${{ steps.emit-commit-ref.outputs.test-sha }}
       target-repo: ${{ steps.emit-commit-ref.outputs.test-repo }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - name: Parse Labeling Event
       id: parse-label-event

.github/workflows/python-style.yml

@@ -14,6 +14,8 @@ on:
 jobs:
   enforce:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - name: Checkout code
       uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

.github/workflows/scan-branch-sbom.yaml

@@ -15,6 +15,8 @@ on:
 jobs:
   grype:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout repo
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0