Merge pull request #966 from bastelfreak/releae

CI jobs: Add explicit token permissions

Author: bastelfreak

.github/workflows/main.yml

@@ -7,6 +7,9 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   unit:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -6,6 +6,9 @@ on:
     tags:
       - '*'
 
+permissions:
+  contents: write
+
 jobs:
   release:
     runs-on: ubuntu-24.04

.github/workflows/update.yml

@@ -7,6 +7,9 @@ on:
     tags:
       - '*'
 
+permissions:
+  contents: read
+
 env:
   GIT_AUTHOR_NAME: pccibot
   GIT_AUTHOR_EMAIL: [email protected]

moduleroot/.github/workflows/ci.yml.erb

@@ -17,6 +17,9 @@ concurrency:
   group: ${{ github.ref_name }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   puppet:
     name: Puppet

moduleroot/.github/workflows/labeler.yml.erb

@@ -8,6 +8,10 @@ name: "Pull Request Labeler"
 on:
   pull_request_target: {}
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   labeler:
     permissions:

moduleroot/.github/workflows/prepare_release.yml.erb

@@ -11,6 +11,10 @@ on:
         description: 'Module version to be released. Must be a valid semver string without leading v. (1.2.3)'
         required: false
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   release_prep:
     uses: 'voxpupuli/gha-puppet/.github/workflows/prepare_release.yml@v3'

moduleroot/.github/workflows/release.yml.erb

@@ -10,6 +10,9 @@ on:
     tags:
       - '*'
 
+permissions:
+  contents: write
+
 jobs:
   release:
     name: Release