ci: restrict workflow permissions

.github/workflows/almalinux-8-build.yml

@@ -24,6 +24,9 @@ on:
   schedule:
     - cron: '42 8 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest

.github/workflows/android-static-build.yml

@@ -28,6 +28,9 @@ on:
     - cron: '42 8 * * 1'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   # Minimum supported API level. 24 (Android 7.0) runs on every modern
   # phone while keeping broad reach; bump if you need newer Bionic APIs.

.github/workflows/asan-build.yml

@@ -23,6 +23,9 @@ on:
     - cron: '42 9 * * 1'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   asan:
     runs-on: ubuntu-latest

.github/workflows/coverage.yml

@@ -19,6 +19,9 @@ on:
     - cron: '42 9 * * 1'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   coverage:
     runs-on: ubuntu-latest

.github/workflows/cygwin-build.yml

@@ -18,6 +18,9 @@ on:
   schedule:
     - cron: '42 8 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: windows-2022

.github/workflows/fleettest.yml

@@ -31,6 +31,9 @@ on:
   schedule:
     - cron: '17 7 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   fleettest:
     runs-on: ubuntu-latest

.github/workflows/freebsd-build.yml

@@ -18,6 +18,9 @@ on:
   schedule:
     - cron: '42 8 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest

.github/workflows/macos-build.yml

@@ -18,6 +18,9 @@ on:
   schedule:
     - cron: '42 8 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: macos-latest

.github/workflows/netbsd-build.yml

@@ -18,6 +18,9 @@ on:
   schedule:
     - cron: '42 8 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest

.github/workflows/openbsd-build.yml

@@ -18,6 +18,9 @@ on:
   schedule:
     - cron: '42 8 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest

.github/workflows/scan-build.yml

@@ -17,6 +17,9 @@ on:
       - '!.github/workflows/scan-build.yml'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   # GATING run: pinned clang-18 on a pinned runner so the checker set -- and
   # thus the expected zero -- is deterministic.  The tree is kept clean for

.github/workflows/solaris-build.yml

@@ -18,6 +18,9 @@ on:
   schedule:
     - cron: '42 8 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest

.github/workflows/ubuntu-build.yml

@@ -18,6 +18,9 @@ on:
   schedule:
     - cron: '42 8 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     strategy:

.github/workflows/ubuntu-version-mix.yml

@@ -39,6 +39,9 @@ on:
   schedule:
     - cron: '52 8 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   version-mix:
     runs-on: ubuntu-latest

.github/workflows/valgrind.yml

@@ -19,6 +19,9 @@ on:
     - cron: '17 4 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   memcheck:
     runs-on: ubuntu-latest