[chore] add default permissions block to workflows (#959)

This addresses a few of the dependabot warnings for the repo.

Signed-off-by: Alex Boten <223565+codeboten@users.noreply.github.com>

Author: codeboten

.github/workflows/base-ci-goreleaser.yaml

@@ -1,5 +1,8 @@
 name: Reusable GoReleaser CI workflow
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     inputs:
@@ -64,6 +67,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup QEMU
         uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
@@ -264,6 +268,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Setup QEMU
         uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0

.github/workflows/base-package-tests.yaml

@@ -1,5 +1,8 @@
 name: Package Tests
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     inputs:
@@ -25,6 +28,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Download built artifacts
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0

.github/workflows/base-release.yaml

@@ -1,5 +1,8 @@
 name: Reusable release workflow
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     inputs:
@@ -42,6 +45,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
 
@@ -154,6 +158,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
 

.github/workflows/builder-release.yaml

@@ -1,4 +1,8 @@
 name: Release Builder
+
+permissions:
+  contents: read
+
 on:
   push:
     tags:
@@ -22,6 +26,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Push cmd/builder Tag
         run: |
           tag="cmd/builder/${{ github.ref_name }}"
@@ -37,6 +42,7 @@ jobs:
           repository: "open-telemetry/opentelemetry-collector"
           ref: ${{ github.ref_name }}
           path: ".core"
+          persist-credentials: false
       - name: Copy Dockerfile to Core Repo directory
         run:  cp cmd/builder/Dockerfile .core/cmd/builder/Dockerfile
       - uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2

.github/workflows/builder-testbuild.yaml

@@ -1,5 +1,8 @@
 name: CI - Builder
 
+permissions:
+  contents: read
+
 on:
   merge_group: 
   push:
@@ -35,12 +38,14 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Checkout Core Repo
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
           repository: "open-telemetry/opentelemetry-collector"
           path: ".core"
+          persist-credentials: false
       - name: Copy Dockerfile to Core Repo directory
         run:  cp cmd/builder/Dockerfile .core/cmd/builder/Dockerfile
       - uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2

.github/workflows/changelog.yml

@@ -5,6 +5,9 @@
 
 name: Changelog
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     types: [opened, synchronize, reopened, labeled, unlabeled]
@@ -28,10 +31,11 @@ jobs:
       PR_HEAD: ${{ github.event.pull_request.head.sha }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
-      - uses: actions/setup-go@v5
+          persist-credentials: false
+      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
         with:
           go-version: "~1.24"
           cache: false

.github/workflows/ci-goreleaser-contrib.yaml

@@ -1,5 +1,8 @@
 name: CI - Contrib - GoReleaser
 
+permissions:
+  contents: read
+
 on:
   merge_group: 
   push:

.github/workflows/ci-goreleaser-core.yaml

@@ -1,5 +1,8 @@
 name: CI - Core - GoReleaser
 
+permissions:
+  contents: read
+
 on:
   merge_group: 
   push:

.github/workflows/ci-goreleaser-ebpf-profiler.yaml

@@ -1,5 +1,8 @@
 name: CI - eBPF Profiler - GoReleaser
 
+permissions:
+  contents: read
+
 on:
   merge_group:
   push:

.github/workflows/ci-goreleaser-k8s.yaml

@@ -1,5 +1,8 @@
 name: CI - k8s - GoReleaser
 
+permissions:
+  contents: read
+
 on:
   merge_group: 
   push: