chore: Set explicit worflow permissions

Author: davidkna-sap

.github/workflows/api-docs.yml

@@ -14,8 +14,12 @@ on:
         required: true
         type: string
 
+permissions: {}
+
 jobs:
   generate-and-push-docs:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - uses: sap/cloud-sdk-js/.github/actions/setup@main

.github/workflows/auto-dependabot-fix.yml

@@ -3,8 +3,12 @@ name: auto-dependabot-fix
 on:
   pull_request_target: ~
 
+permissions: {}
+
 jobs:
   building:
+    permissions:
+      contents: read
     if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == github.event.pull_request.head.repo.full_name
     runs-on: ubuntu-latest
     steps:

.github/workflows/auto-lint.yml

@@ -3,8 +3,12 @@ name: auto-lint-fix
 on:
   pull_request: ~
 
+permissions: {}
+
 jobs:
   linting:
+    permissions:
+      contents: read
     if: github.actor != 'dependabot[bot]' && github.repository == github.event.pull_request.head.repo.full_name
     runs-on: ubuntu-latest
     steps:

.github/workflows/blackduck.yml

@@ -5,9 +5,13 @@ on:
   schedule:
     - cron: 0 23 * * *
 
+permissions: {}
+
 jobs:
   tests:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     timeout-minutes: 15
     steps:
       - uses: sap/cloud-sdk-js/.github/actions/setup@main

.github/workflows/build.yml

@@ -21,11 +21,15 @@ on:
         required: false
         default: false
 
+permissions: {}
+
 jobs:
   tests:
     if: inputs.canary-release-skip-checks == false
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -58,6 +62,8 @@ jobs:
   checks:
     if: inputs.canary-release-skip-checks == false
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: sap/cloud-sdk-js/.github/actions/setup@main
         with:
@@ -99,6 +105,8 @@ jobs:
   e2e-tests:
     if: inputs.canary-release-skip-checks == false
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: sap/cloud-sdk-js/.github/actions/setup@main
         with:
@@ -133,6 +141,8 @@ jobs:
   canary-release-pre-check:
     if: inputs.is-workflow-call && inputs.canary-release-skip-checks == false
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       skip-release: ${{ steps.date-check.outputs.skip-release }}
     needs: [tests, checks, e2e-tests]
@@ -167,6 +177,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [canary-release-pre-check]
     permissions:
+      contents: read
       id-token: write
     steps:
       - uses: sap/cloud-sdk-js/.github/actions/setup@main
@@ -189,6 +200,8 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     needs: [tests, checks]
+    permissions:
+      contents: write
     steps:
       - uses: sap/cloud-sdk-js/.github/actions/setup@main
         with:

.github/workflows/bump.yml

@@ -7,9 +7,13 @@ on:
         description: Mandatory, when bumping a major version. Semver compatible version string (X.Y.Z). Must not be set for patch and minor version releases.
         required: false
 
+permissions: {}
+
 jobs:
   bump:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       version: ${{ steps.bump.outputs.version }}
     steps:
@@ -56,6 +60,8 @@ jobs:
   generate-api-docs:
     name: Generate and Push API Documentation
     needs: [bump]
+    permissions:
+      contents: read
     uses: ./.github/workflows/api-docs.yml
     secrets: inherit
     with:

.github/workflows/check-pr.yml

@@ -7,9 +7,13 @@ on:
       - edited
       - synchronize
 
+permissions: {}
+
 jobs:
   check-pr:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:

.github/workflows/codeql-analysis.yml

@@ -14,10 +14,15 @@ on:
   pull_request: ~
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
 
     strategy:
       fail-fast: false

.github/workflows/downloads.yml

@@ -5,9 +5,13 @@ on:
   schedule:
     - cron: '0 0 * * 1'
 
+permissions: {}
+
 jobs:
   downloads:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: sap/cloud-sdk-js/.github/actions/setup@main
         with:

.github/workflows/fosstars-report.yml

@@ -4,6 +4,8 @@ on:
   schedule:
     - cron: '0 0 * * *'
 
+permissions: {}
+
 jobs:
   create_fosstars_report:
     runs-on: ubuntu-latest