workflows: add permissions

Author: msimerson

.github/workflows/ci.yml

@@ -7,6 +7,8 @@ env:
 jobs:
   get-lts:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - id: get
         uses: msimerson/node-lts-versions@v1
@@ -17,6 +19,8 @@ jobs:
   check-output:
     needs: get-lts
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]

.github/workflows/codeql.yml

@@ -14,15 +14,15 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           languages: javascript
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@v4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4

.github/workflows/coverage.yml

@@ -10,6 +10,8 @@ env:
 jobs:
   coverage:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/setup-node@v6
         name: Node ${{ env.node-version }}

.github/workflows/lint.yml

@@ -5,19 +5,14 @@ on:
 
 env:
   CI: true
-  node-version: lts/*
 
 jobs:
   lint:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/setup-node@v6
-        name: Node ${{ env.node-version }}
-        with:
-          node-version: ${{ env.node-version }}
-
       - uses: actions/checkout@v6
-
       - run: npm install
-
       - run: npm run lint

.github/workflows/publish.yml

@@ -10,6 +10,8 @@ env:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/setup-node@v6
         name: Node ${{ env.node-version }}
@@ -35,7 +37,7 @@ jobs:
         with:
           fetch-depth: 0
           # fetch-depth 0 needed by GitHub Release
-      - run: npm publish --access=public
+      - run: npm publish --access public
 
   publish-gpr:
     needs: build

.github/workflows/test.yml

@@ -7,6 +7,8 @@ jobs:
   test:
     needs: get-lts
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     strategy:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
@@ -24,6 +26,8 @@ jobs:
 
   get-lts:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - id: get
         uses: msimerson/node-lts-versions@v1

FUNDING.yml

@@ -0,0 +1 @@
+github: msimerson

workflow-templates/ci.yml

@@ -10,11 +10,17 @@ env:
 jobs:
   lint:
     uses: NicTool/.github/.github/workflows/lint.yml@main
+    permissions:
+      contents: read
 
   coverage:
     uses: NicTool/.github/.github/workflows/coverage.yml@main
     secrets: inherit
+    permissions:
+      contents: read
 
   test:
     uses: NicTool/.github/.github/workflows/test.yml@main
     secrets: inherit
+    permissions:
+      contents: read

workflow-templates/codeql.yml

@@ -12,3 +12,7 @@ on:
 jobs:
   codeql:
     uses: NicTool/.github/.github/workflows/codeql.yml@main
+    permissions:
+      actions: read
+      contents: read
+      security-events: write

workflow-templates/coverage.yml

@@ -10,3 +10,5 @@ jobs:
   coverage:
     uses: NicTool/.github/.github/workflows/coverage.yml@main
     secrets: inherit
+    permissions:
+      contents: read