Scope down GitHub Token Permissions

.github/workflows/lint-javascript.yml

@@ -4,6 +4,10 @@ on:  # yamllint disable-line rule:truthy
   pull_request:
   workflow_dispatch:
 
+
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: Lint Javascript

.github/workflows/lint-kotlin.yml

@@ -4,6 +4,10 @@ on:  # yamllint disable-line rule:truthy
   workflow_dispatch:
   pull_request:
 
+
+permissions:
+  contents: read
+
 jobs:
   ktlint:
     name: Lint Kotlin

.github/workflows/lint-php.yml

@@ -8,6 +8,10 @@ on:  # yamllint disable-line rule:truthy
       - ".github/linters/phpcs.xml"
       - ".github/workflows/php-lint.yml"
 
+
+permissions:
+  contents: read
+
 jobs:
   phpcs:
     name: "PHP Linter"

.github/workflows/lint-ruby.yml

@@ -4,6 +4,10 @@ on:  # yamllint disable-line rule:truthy
   pull_request:
   workflow_dispatch:
 
+
+permissions:
+  contents: read
+
 jobs:
   rubocop:
     name: RuboCop

.github/workflows/writeme.yml

@@ -11,6 +11,10 @@ on:  # yamllint disable-line rule:truthy
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+
+permissions:
+  contents: read
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   # This workflow contains a single job called "build"

.github/workflows/yaml-lint.yml

@@ -4,6 +4,10 @@ on:  # yamllint disable-line rule:truthy
   pull_request:
   workflow_dispatch:
 
+
+permissions:
+  contents: read
+
 jobs:
   yamllint:
     name: Lint Yaml