Add explicit permissions to GitHub Actions workflows

.github/workflows/backend.yml

@@ -20,11 +20,16 @@ on:
       - 'backend/**'
       - '.github/workflows/backend.yml'
 
+permissions:
+  contents: read
+
 jobs:
   generate-lockfile:
     name: Generate lockfile
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'pull_request'}}
+    permissions:
+      contents: write
 
     outputs:
       files_changed: ${{ steps.verify-changed-files.outputs.files_changed }}

.github/workflows/compress-images.yml

@@ -16,6 +16,10 @@ on:
       - '**.webp'
   workflow_dispatch:
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   compress-images:
     name: Compress images

.github/workflows/frontend-admin.yml

@@ -8,6 +8,10 @@ on:
     paths:
       - 'frontend-admin/**'
       - '.github/workflows/frontend-admin.yml'
+
+permissions:
+  contents: read
+
 jobs:
   run-tests:
     name: Run tests

.github/workflows/frontend-base-workflow.yml

@@ -22,6 +22,9 @@ on:
         default: false
         type: boolean
 
+permissions:
+  contents: read
+
 jobs:
   run-tests:
     name: Run tests

.github/workflows/frontend.yml

@@ -8,6 +8,10 @@ on:
     paths:
       - 'frontend/**'
       - '.github/workflows/frontend.yml'
+
+permissions:
+  contents: read
+
 jobs:
   run-tests:
     name: Run tests

.github/workflows/schema-validation.yml

@@ -7,6 +7,9 @@ on:
       - 'backend/**'
       - '.github/workflows/schema-validation.yml'
 
+permissions:
+  contents: read
+
 jobs:
   validate-schema:
     name: OpenAPI schema validation