github: set top-level read-only workflow permissions (#6775)

.github/workflows/codeql-analysis.yml

@@ -8,16 +8,18 @@ on:
 
 permissions:
   contents: read
-  security-events: write
-  pull-requests: read
-  actions: read
 
 jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
     timeout-minutes: 30
 
+    permissions:
+      security-events: write
+      pull-requests: read
+      actions: read
+
     strategy:
       fail-fast: false
 

.github/workflows/coverage.yml

@@ -1,5 +1,9 @@
 name: codecov
 on: [push, pull_request]
+
+permissions:
+  contents: read
+
 jobs:
   upload:
     runs-on: ubuntu-latest

.github/workflows/lock.yml

@@ -6,12 +6,14 @@ on:
     - cron: '22 1 * * *'
 
 permissions:
-  issues: write
-  pull-requests: write
+  contents: read
 
 jobs:
   lock:
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
       - uses: dessant/lock-threads@v2
         with:

.github/workflows/release.yml

@@ -4,6 +4,9 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
 jobs:
   release:
     permissions:

.github/workflows/stale.yml

@@ -5,6 +5,9 @@ on:
   schedule:
   - cron: "44 */2 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   stale:
     runs-on: ubuntu-latest