[Security] Updated token permissions (#1389) (#2326)

Co-authored-by: Sourabh Mehta <73165318+soumeh01@users.noreply.github.com>

Author: grasci-arm

.github/workflows/buildmgr.yml

@@ -35,6 +35,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   setup:
     uses: Open-CMSIS-Pack/devtools/.github/workflows/shared_setup_env.yml@main
@@ -215,6 +218,8 @@ jobs:
     # Debian package generation in ubuntu 22.04 produces incompatible metadata
     runs-on: ubuntu-22.04
     timeout-minutes: 15
+    permissions:
+      contents: write
     steps:
       - name: Harden Runner
         if: ${{ !github.event.repository.private }}
@@ -506,8 +511,7 @@ jobs:
         AC6_TOOLCHAIN_6_18_0: ${{ github.workspace }}/${{ matrix.toolchain_root }}
     runs-on: ubuntu-22.04
     timeout-minutes: 15
-    strategy:
-      fail-fast: true
+
     steps:
       - name: Harden Runner
         if: ${{ !github.event.repository.private }}

.github/workflows/codeql-analysis.yml

@@ -19,6 +19,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze

.github/workflows/global.yaml

@@ -3,6 +3,7 @@ on:
   pull_request:
   release:
     types: [ published ]
+
 permissions:
   contents: read
 

.github/workflows/markdown.yml

@@ -6,6 +6,14 @@ on:
       - '.github/markdownlint.json'
       - '.github/markdownlint.jsonc'
       - '**/*.md'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   linter:
     name: Lint markdown files

.github/workflows/nightly.yml

@@ -1,11 +1,13 @@
-
 name: nightly
 
 on:
   workflow_dispatch:
   schedule:
     - cron: '0 0 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   buildmgr:
     if: github.repository == 'Open-CMSIS-Pack/devtools'

.github/workflows/packchk.yml

@@ -40,6 +40,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   setup:
     uses: Open-CMSIS-Pack/devtools/.github/workflows/shared_setup_env.yml@main
@@ -60,6 +63,8 @@ jobs:
     strategy:
       fail-fast: true
       matrix: ${{ fromJson(needs.matrix_prep.outputs.matrix) }}
+    permissions:
+      contents: write
     steps:
       - name: Harden Runner
         if: ${{ !github.event.repository.private }}
@@ -324,6 +329,8 @@ jobs:
           if-no-files-found: error
 
   release:
+    permissions:
+      contents: write
     if: |
         github.event_name == 'release' &&
         startsWith(github.ref, 'refs/tags/tools/packchk/')

.github/workflows/packgen.yml

@@ -35,6 +35,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   setup:
     uses: Open-CMSIS-Pack/devtools/.github/workflows/shared_setup_env.yml@main
@@ -114,7 +117,8 @@ jobs:
     needs: [ build, unittest ]
     runs-on: ubuntu-22.04
     timeout-minutes: 15
-
+    permissions:
+      contents: write
     steps:
       - name: Checkout devtools
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

.github/workflows/projmgr.yml

@@ -1,4 +1,3 @@
-
 name: projmgr
 on:
   workflow_call:
@@ -40,6 +39,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   setup:
     uses: Open-CMSIS-Pack/devtools/.github/workflows/shared_setup_env.yml@main
@@ -204,6 +206,8 @@ jobs:
     needs: [ build, build-swig, unittest, coverage ]
     runs-on: ubuntu-22.04
     timeout-minutes: 15
+    permissions:
+      contents: write
 
     steps:
       - name: Checkout devtools

.github/workflows/scorecard.yml

@@ -11,22 +11,17 @@ on:
     branches: [ "main" ]
   workflow_dispatch:
 
-# Declare default permissions as read only.
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   analysis:
     if: github.repository == 'Open-CMSIS-Pack/devtools'
     name: Scorecard analysis
     runs-on: ubuntu-latest
     permissions:
-      # Needed to upload the results to code-scanning dashboard.
       security-events: write
-      # Needed to publish results and get a badge (see publish_results below).
       id-token: write
-      # Uncomment the permissions below if installing in a private repository.
-      # contents: read
-      # actions: read
 
     steps:
       - name: Harden Runner

.github/workflows/svdconv.yml

@@ -32,6 +32,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   setup:
     uses: Open-CMSIS-Pack/devtools/.github/workflows/shared_setup_env.yml@main
@@ -52,6 +55,8 @@ jobs:
     strategy:
       fail-fast: true
       matrix: ${{ fromJson(needs.matrix_prep.outputs.matrix) }}
+    permissions:
+      contents: write
     steps:
       - name: Harden Runner
         if: ${{ !github.event.repository.private }}