Update github permissions (#833)

* Update github permissions

* Replace version by commit sha

Author: tpadioleau

.github/workflows/cmake-checks.yaml

@@ -25,6 +25,9 @@ on:
       - '**.cmake.in'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   cmake-format:
     name: CMake format check using gersemi

.github/workflows/early_integration.yaml

@@ -11,6 +11,9 @@ on:
     - cron: "0 1 * * 1-5"  # every weekday at 1am
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   docker-build:
     strategy:
@@ -83,6 +86,8 @@ jobs:
             cxx_version: '23'
     runs-on: ubuntu-latest
     needs: [docker-build]
+    permissions:
+      checks: write  # Required by mikepenz/action-junit-report
     steps:
       - name: Free Disk Space (Ubuntu)
         uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be  # v1.3.1

.github/workflows/general-checks.yaml

@@ -13,6 +13,9 @@ on:
       - main
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   reuse-compliance-check:
     name: Reuse compliance check

.github/workflows/gyselalibxx.yaml

@@ -9,6 +9,9 @@ name: gyselalibxx
 on:
   workflow_dispatch
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     strategy:

.github/workflows/markdown-checks.yaml

@@ -19,6 +19,9 @@ on:
       - '**.md'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   markdown-lint:
     name: Markdown lint using markdownlint-cli2

.github/workflows/packages-cleanup.yaml

@@ -9,6 +9,9 @@ name: Packages cleanup
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   delete-packages:
     strategy:
@@ -24,6 +27,8 @@ jobs:
           - 'oldest_hip'
     name: Delete old packages
     runs-on: ubuntu-latest
+    permissions:
+      packages: write  # Required by actions/delete-package-versions
     steps:
       - uses: actions/delete-package-versions@e5bc658cc4c965c472efe991f8beea3981499c55  # v5.0.0
         with:

.github/workflows/pages.yaml

@@ -16,6 +16,9 @@ concurrency:
   group: ${{github.workflow}}-${{github.ref == github.ref_protected && github.run_id || github.event.pull_request.number || github.ref}}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   id_repo:
     runs-on: ubuntu-latest
@@ -29,6 +32,8 @@ jobs:
   docker-build:
     needs: id_repo
     runs-on: ubuntu-latest
+    permissions:
+      packages: write  # Required to push to registry
     steps:
       - name: Free Disk Space (Ubuntu)
         uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be  # v1.3.1

.github/workflows/python-checks.yaml

@@ -21,6 +21,9 @@ on:
       - 'bin/trailing_spaces'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   python-format:
     name: Python format using black

.github/workflows/scorecard.yaml

@@ -23,7 +23,8 @@ on:
       - "main"
 
 # Declare default permissions as read only.
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   analysis:
@@ -78,6 +79,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@45775bd8235c68ba998cffa5171334d58593da47  # v3.28.15
         with:
           sarif_file: results.sarif

.github/workflows/shell-checks.yaml

@@ -15,6 +15,9 @@ on:
       - 'docker/*/bash_run'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   shell-lint:
     name: Shell lint using shellcheck