Audit workflow permissions

.github/workflows/build-samples.yml

@@ -2,14 +2,20 @@ name: Build Images
 
 on:
   pull_request:
+    branches: [ "main" ]
   push:
+    branches: [ "main" ]
   workflow_dispatch:
 
 jobs:
   # Build a single-arch nginx image for each arch.
   build-nginx-on-all-arches:
     name: build-nginx-all-arches
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
     strategy:
       fail-fast: false
       matrix:
@@ -45,6 +51,9 @@ jobs:
     name: build-nginx-multiarch
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v2.1.5
@@ -66,6 +75,10 @@ jobs:
 
   build-all-examples-one-arch:
     name: build-all-examples-amd64
+
+    permissions:
+      contents: read
+
     strategy:
       fail-fast: false
       matrix:
@@ -88,6 +101,9 @@ jobs:
     name: source-date-epoch
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v2.1.5
@@ -120,6 +136,9 @@ jobs:
     name: build-date-epoch
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v2.1.5
@@ -151,6 +170,10 @@ jobs:
   annotations:
     name: annotations
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v2.1.5

.github/workflows/build.yaml

@@ -2,17 +2,18 @@ name: ci
 
 on:
   pull_request:
-    branches:
-      - main
+    branches: [ "main" ]
   push:
-    branches:
-      - main
+    branches: [ "main" ]
 
 jobs:
   build:
     name: build
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 

.github/workflows/codeql.yaml

@@ -2,16 +2,20 @@ name: CodeQL
 
 on:
   push:
-    branches:
-      - main
+    branches: [ "main" ]
   pull_request:
+    branches: [ "main" ]
 
 env:
   CODEQL_EXTRACTOR_GO_BUILD_TRACING: true
 
 jobs:
   analyze:
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
     steps:
     - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 

.github/workflows/go-tests.yaml

@@ -2,13 +2,17 @@ name: Go Tests
 
 on:
   push:
-    branches:
-      - main
+    branches: [ "main" ]
   pull_request:
+    branches: [ "main" ]
 
 jobs:
   test:
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
     steps:
     - name: Install Go
       uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v3.0.0

.github/workflows/verify.yaml

@@ -2,13 +2,18 @@ name: verify
 
 on:
   push:
+    branches: [ "main" ]
   pull_request:
+    branches: [ "main" ]
 
 jobs:
   golangci:
     name: lint
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v2.2.0