chore: GH workflow permissions (#532)

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

Author: jkowalleck

.github/workflows/php-dev.yml

@@ -26,6 +26,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 env:
   PHP_VERSION_LATEST: "8.4"
   PHP_PROJECT_EXT: dom,filter,json,libxml,simplexml  # via `composer info -pt`

.github/workflows/php.yml

@@ -17,6 +17,8 @@ concurrency:
   group: '${{ github.workflow }}-${{ github.ref }}'
   cancel-in-progress: true
 
+permissions: {}
+
 env:
   PHP_VERSION_LOWEST: "8.1"  # lowest supported
   PHP_VERSION_LATEST: "8.4"  # highest supported

.github/workflows/release.yml

@@ -26,10 +26,14 @@ name: Release
 on:
   workflow_dispatch
 
+permissions: {}
+
 jobs:
   release:
     name: Release
-    permissions: write-all
+    permissions:
+      id-token: write
+      contents: write  # to create a release
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps: