security: add permissions block to workflows

.github/workflows/build-distribution.yml

@@ -3,6 +3,9 @@ name: build-distribution
 on:
   workflow_call: ~
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/packages.yml

@@ -13,6 +13,9 @@ on:
       - '**/*.md'
       - '**/*.asciidoc'
 
+permissions:
+  contents: read
+
 # Override the version if there is no tag release.
 env:
   ELASTIC_CI_POST_VERSION: ${{ startsWith(github.ref, 'refs/tags') && '' || github.run_id }}

.github/workflows/pre-commit.yml

@@ -5,6 +5,9 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   pre-commit:
     runs-on: ubuntu-latest

.github/workflows/run-matrix.yml

@@ -8,6 +8,9 @@ on:
         description: Matrix include JSON string
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   docker:
     name: "docker (version: ${{ matrix.version }}, framework: ${{ matrix.framework }})"

.github/workflows/test-reporter.yml

@@ -8,6 +8,11 @@ on:
     types:
       - completed
 
+permissions:
+  contents: read
+  actions: read
+  checks: write
+
 jobs:
   report:
     runs-on: ubuntu-latest

.github/workflows/test.yml

@@ -30,6 +30,9 @@ on:
         required: true
         type: boolean
 
+permissions:
+  contents: read
+
 jobs:
   build-distribution:
     uses: ./.github/workflows/build-distribution.yml