ci: add workflows for QA on code/config (#80)

.github/workflows/build-image.yml

@@ -7,6 +7,8 @@ on:
         type: boolean
         default: false
 
+permissions:
+  contents: read
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}

.github/workflows/ci.yml

@@ -3,6 +3,8 @@ name: CI
 on:
   pull_request: {}
 
+permissions:
+  contents: read
 jobs:
   build-image:
     uses: ./.github/workflows/build-image.yml

.github/workflows/clean-ghcr.yaml

@@ -7,6 +7,8 @@ on:
 #    - cron: "0 1 * * *"  # every day at midnight
   workflow_dispatch:
 
+permissions:
+  contents: read
 jobs:
   trigger:
     uses: statnett/github-workflows/.github/workflows/clean-ghcr.yaml@main

.github/workflows/codeql.yaml

@@ -0,0 +1,23 @@
+---
+name: CodeQL
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: "34 0 * * 3"
+
+permissions:
+  contents: read
+jobs:
+  trigger:
+    uses: statnett/github-workflows/.github/workflows/codeql.yaml@main
+    with:
+      language: java
+    permissions:
+      actions: read
+      contents: read
+      security-events: write

.github/workflows/lint-pr.yml

@@ -7,6 +7,8 @@ on:
       - edited
       - synchronize
 
+permissions:
+  contents: read
 jobs:
   trigger:
     uses: statnett/github-workflows/.github/workflows/lint-pr.yaml@main

.github/workflows/main.yml

@@ -7,6 +7,8 @@ on:
     tags:
       - v*
 
+permissions:
+  contents: read
 jobs:
   build-push-image:
     if: ${{ github.repository == 'statnett/k3a-lag-exporter' }}

.github/workflows/release-please.yml

@@ -6,6 +6,8 @@ on:
       - main
   workflow_dispatch:
 
+permissions:
+  contents: read
 jobs:
   trigger:
     uses: statnett/github-workflows/.github/workflows/release-please.yaml@main

.github/workflows/scorecard.yaml

@@ -0,0 +1,20 @@
+---
+name: Scorecard supply-chain security
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: "20 7 * * 2"
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+jobs:
+  trigger:
+    uses: statnett/github-workflows/.github/workflows/scorecard.yaml@main
+    permissions:
+      security-events: write
+      id-token: write
+      contents: read
+      actions: read