chore: declare workflow-level permissions on eight workflows (#3407)

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
Co-authored-by: Andrew Peabody <andrewpeabody@google.com>

Author: arpitjain099

.github/workflows/go-fbf-test.yml

@@ -12,6 +12,9 @@ concurrency:
   group: '${{github.workflow}}-${{ github.head_ref || github.ref }}'
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   unit:
     name: ${{ matrix.operating-system }} unit tests

.github/workflows/go-module-swapper.yml

@@ -12,6 +12,9 @@ concurrency:
   group: '${{github.workflow}}-${{ github.head_ref || github.ref }}'
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   unit:
     name: ${{ matrix.operating-system }} unit tests

.github/workflows/go-tflint-plugin.yml

@@ -18,6 +18,9 @@ concurrency:
   group: '${{github.workflow}}-${{ github.head_ref || github.ref }}'
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   unit:
     name: ${{ matrix.operating-system }} unit tests

.github/workflows/lint.yaml

@@ -26,6 +26,9 @@ concurrency:
   group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: 'lint-infra-terraform'

.github/workflows/pre-commit.yml

@@ -5,6 +5,9 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   pre-commit:
     runs-on: ubuntu-latest

.github/workflows/test-cft-devtools.yml

@@ -11,6 +11,9 @@ concurrency:
   group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   build-dev-tools:
     name: Build CFT dev tools image

.github/workflows/test-cli.yml

@@ -18,6 +18,9 @@ concurrency:
   group: '${{github.workflow}}-${{ github.head_ref || github.ref }}'
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   unit:
     name: ${{ matrix.operating-system }} unit tests

.github/workflows/update-tooling.yml

@@ -24,6 +24,10 @@ env:
   TFLINT_URL: "https://api.github.com/repos/terraform-linters/tflint/releases/latest"
   GOLANGCI_URL: "https://api.github.com/repos/golangci/golangci-lint/releases/latest"
 
+permissions:
+  contents: write       # peter-evans/create-pull-request pushes a branch
+  pull-requests: write  # peter-evans/create-pull-request opens the PR
+
 jobs:
   update-tools:
     runs-on: ubuntu-latest