🔒 Give initial script enough permissions for subscripts

Author: shnizzedy

.github/workflows/build_C-PAC.yml

@@ -1,6 +1,13 @@
 name: Build C-PAC image
 
-permissions: read-all
+permissions:
+  checks: write
+  contents: read
+  deployments: write
+  issues: write
+  packages: write
+  pull-requests: write
+  statuses: write
 
 on:
   workflow_call:

.github/workflows/build_and_test.yml

@@ -17,9 +17,13 @@
 name: Build and test C-PAC
 
 permissions:
+  checks: write
   contents: read
+  deployments: write
+  issues: write
   packages: write
-  pull-requests: read
+  pull-requests: write
+  statuses: write
 
 on:
   workflow_call:

.github/workflows/deploy_to_Docker_Hub.yml

@@ -1,6 +1,13 @@
 name: Deploy to Docker Hub
 
-permissions: read-all
+permissions:
+  checks: write
+  contents: read
+  deployments: write
+  issues: write
+  packages: write
+  pull-requests: write
+  statuses: write
 
 on:
   workflow_call:

.github/workflows/on_push.yml

@@ -16,7 +16,14 @@
 # License along with C-PAC. If not, see <https://www.gnu.org/licenses/>.
 name: Build and test C-PAC
 
-permissions: read-all
+permissions:
+  checks: write
+  contents: read
+  deployments: write
+  issues: write
+  packages: write
+  pull-requests: write
+  statuses: write
 
 on:
   push:

.github/workflows/regression_test_full.yml

@@ -1,6 +1,13 @@
 name: Run Regression Full Test
 
-permissions: read-all
+permissions:
+  checks: write
+  contents: read
+  deployments: write
+  issues: write
+  packages: write
+  pull-requests: write
+  statuses: write
 
 on:
   workflow_call:

.github/workflows/regression_test_lite.yml

@@ -1,6 +1,13 @@
 name: Launch lite regression test
 
-permissions: read-all
+permissions:
+  checks: write
+  contents: read
+  deployments: write
+  issues: write
+  packages: write
+  pull-requests: write
+  statuses: write
 
 on:
   pull_request:

.github/workflows/smoke_test_participant.yml

@@ -16,7 +16,14 @@
 # License along with C-PAC. If not, see <https://www.gnu.org/licenses/>.
 name: Run participant smoke test
 
-permissions: read-all
+permissions:
+  checks: write
+  contents: read
+  deployments: write
+  issues: write
+  packages: write
+  pull-requests: write
+  statuses: write
 
 on:
   workflow_call: