ci: set permissions to workflows (#376)

ci: set permissions

Author: sapphi-red

.github/workflows/ci.yml

@@ -23,6 +23,8 @@ jobs:
   ci:
     timeout-minutes: 10
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # to clone the repo
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4

.github/workflows/ecosystem-ci-from-pr.yml

@@ -76,6 +76,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       comment-id: ${{ steps.create-comment.outputs.result }}
+    permissions: {}
     steps:
       - id: generate-token
         uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a #v2.1.0
@@ -107,6 +108,8 @@ jobs:
     if: "inputs.suite != '-'"
     outputs:
       ref: ${{ steps.get-ref.outputs.ref }}
+    permissions:
+      contents: read # to clone the repo
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -139,6 +142,8 @@ jobs:
     if: "inputs.suite == '-'"
     outputs:
       ref: ${{ steps.get-ref.outputs.ref }}
+    permissions:
+      contents: read # to clone the repo
     strategy:
       matrix:
         suite:
@@ -205,6 +210,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [init, execute-selected-suite, execute-all]
     if: always()
+    permissions: {}
     steps:
       - id: generate-token
         uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a #v2.1.0

.github/workflows/ecosystem-ci-selected.yml

@@ -78,6 +78,8 @@ jobs:
   execute-selected-suite:
     timeout-minutes: 30
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # to clone the repo
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4

.github/workflows/ecosystem-ci.yml

@@ -81,6 +81,8 @@ jobs:
           - vuepress
           - waku
       fail-fast: false
+    permissions:
+      contents: read # to clone the repo
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4