[gha] Restrict access to read all

Author: hazendaz

.github/workflows/ci.yaml

@@ -2,6 +2,8 @@ name: Java CI
 
 on: [workflow_dispatch, push, pull_request]
 
+permissions: read-all
+
 jobs:
   test:
     runs-on: ${{ matrix.os }}

.github/workflows/site.yaml

@@ -5,6 +5,8 @@ on:
     branches:
       - site
 
+permissions: read-all
+
 jobs:
   build:
     if: github.repository_owner == 'mybatis' && ! contains(toJSON(github.event.head_commit.message), '[maven-release-plugin]')

.github/workflows/sonar.yaml

@@ -5,6 +5,8 @@ on:
     branches:
       - master
 
+permissions: read-all
+
 jobs:
   build:
     if: github.repository_owner == 'mybatis'

.github/workflows/sonatype.yaml

@@ -5,6 +5,8 @@ on:
     branches:
       - master
 
+permissions: read-all
+
 jobs:
   build:
     if: github.repository_owner == 'mybatis' && ! contains(toJSON(github.event.head_commit.message), '[maven-release-plugin]')