Merge pull request #913 from step-security-bot/stepsecurity_remediati…

…on_1717354875

[StepSecurity] ci: Harden GitHub Actions

.github/workflows/definitions.yml

@@ -3,6 +3,8 @@ on:
   schedule: [{cron: '0 */6 * * *'}] # 6hrly https://crontab.guru/#0_*/6_*_*_*
   workflow_dispatch:
 
+permissions: {contents: read}
+
 jobs:
   scrape:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -2,6 +2,8 @@ name: Release
 on:
   push: { tags: 'v[0-9]+.[0-9]+.[0-9]+*' }
 
+permissions: {contents: read}
+
 jobs:
   release:
     permissions: { contents: write, id-token: write}

.github/workflows/sync-default-branch.yml

@@ -3,7 +3,7 @@ on:
   push: { branches: main }
   workflow_dispatch:
 
-permissions: { contents: write }
+permissions: {contents: write}
 
 jobs:
   sync:

.github/workflows/test.yml

@@ -5,7 +5,7 @@ on:
   schedule: [{cron: '0 0 10 * *'}] # monthly https://crontab.guru/#0_0_10_*_*
   workflow_dispatch:
 
-permissions: read-all
+permissions: {contents: read}
 
 jobs:
   test:

.github/workflows/version.yml

@@ -3,6 +3,8 @@ on:
   schedule: [{ cron: '0 10 * * *' }] # daily: https://crontab.guru/#0_10_*_*_*
   workflow_dispatch:
 
+permissions: {contents: read}
+
 jobs:
   bump:
     runs-on: ubuntu-latest