chore(ci): Harden GitHub Actions token permissions

.github/workflows/changelog.yaml

@@ -16,6 +16,9 @@ on:
   merge_group:
     types: [checks_requested]
 
+permissions:
+  contents: read
+
 jobs:
   validate-changelog:
     permissions:

.github/workflows/cleanup-ghcr-images.yml

@@ -13,6 +13,9 @@ on:
     - cron: '0 2 * * 0'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   cleanup:
     runs-on: ubuntu-latest

.github/workflows/gardener_open_issue.yml

@@ -6,6 +6,9 @@ on:
     types:
       - opened
 
+permissions:
+  contents: read
+
 jobs:
   add-to-project:
     name: Add issue to Gardener project board

.github/workflows/labeler.yml

@@ -2,6 +2,9 @@ name: "Pull Request Labeler"
 on:
   pull_request_target:
 
+permissions:
+  contents: read
+
 jobs:
   label:
     runs-on: ubuntu-24.04

.github/workflows/msrv.yml

@@ -14,6 +14,9 @@ env:
   CI: true
   PROFILE: debug
 
+permissions:
+  contents: read
+
 jobs:
   check-msrv:
     runs-on: ubuntu-24.04

.github/workflows/publish-homebrew.yml

@@ -17,6 +17,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   publish-homebrew:
     runs-on: ubuntu-24.04

.github/workflows/semantic.yml

@@ -9,8 +9,14 @@ on:
   pull_request:
     types: [opened, edited, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   main:
+    permissions:
+      pull-requests: read  # for amannn/action-semantic-pull-request to analyze PRs
+      statuses: write  # for amannn/action-semantic-pull-request to mark status of analyzed PR
     name: Check Semantic PR
     runs-on: ubuntu-24.04
     steps:

.github/workflows/spelling.yml

@@ -67,6 +67,9 @@ on:
     - 'reopened'
     - 'synchronize'
 
+permissions:
+  contents: read
+
 jobs:
   spelling:
     name: Check Spelling