ci: limit scope of GITHUB_TOKEN in actions (#1089)

Author: ChristianBeilschmidt

.github/workflows/ci.yml

@@ -13,6 +13,9 @@ jobs:
   test:
     runs-on: ubuntu-24.04
 
+    permissions:
+      contents: read
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -54,6 +57,9 @@ jobs:
     runs-on: ubuntu-24.04
     container: quay.io/geoengine/devcontainer:latest
 
+    permissions:
+      contents: read
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -97,6 +103,9 @@ jobs:
     runs-on: ubuntu-24.04
     container: quay.io/geoengine/devcontainer:latest
 
+    permissions:
+      contents: read
+
     strategy:
       matrix:
         build: ["", "--release"]

.github/workflows/clear-cache.yml

@@ -11,6 +11,10 @@ jobs:
   clear-cache:
     runs-on: ubuntu-24.04
 
+    permissions:
+      actions: write
+      contents: read
+
     steps:
       - name: Clear all caches
         uses: actions/github-script@v6

.github/workflows/containers.yml

@@ -27,6 +27,9 @@ jobs:
 
     runs-on: ubuntu-24.04
 
+    permissions:
+      contents: read
+
     env:
       TAG_NAME: nightly
       CONTAINER_REPOSITORY_BRANCH: main
@@ -110,7 +113,12 @@ jobs:
     name: Post to a Slack channel in case of failure
     needs: create-container
     if: always()
+
     runs-on: ubuntu-24.04
+
+    permissions:
+      contents: read
+
     steps:
       - name: Post to a Slack channel
         if: ${{ needs.create-container.result == 'failure' }}

.github/workflows/devcontainer.yml

@@ -27,6 +27,9 @@ jobs:
 
     runs-on: ubuntu-24.04
 
+    permissions:
+      contents: read
+
     env:
       TAG_NAME: latest
       CONTAINER_REPOSITORY_BRANCH: main
@@ -72,7 +75,12 @@ jobs:
     name: Post to a Slack channel in case of failure
     needs: create-container
     if: always()
+
     runs-on: ubuntu-24.04
+
+    permissions:
+      contents: read
+
     steps:
       - name: Post to a Slack channel
         if: ${{ needs.create-container.result == 'failure' }}

.github/workflows/lint-pr-title.yml

@@ -9,7 +9,12 @@ jobs:
   title:
     name: Title
     if: github.event.action == 'opened' || github.event.changes.title.from
+
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
     steps:
       - uses: geo-engine/conventional-pr-title@v1
         with: