find minimal required permissions

Author: chrjabs

.github/workflows/ci.yml

@@ -25,6 +25,7 @@ jobs:
       - kissat-each-feature
     if: ${{ always() }} # Run this job even if a dependency has failed.
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
       - name: Job outcomes
         run: |
           echo "🧪 Workspace tests: ${{ needs.tests.result }}"
@@ -59,6 +60,7 @@ jobs:
     name: 🏗️ Dev dependencies
     runs-on: [self-hosted, nix]
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
@@ -71,6 +73,7 @@ jobs:
       - dev-deps
     if: '!github.event.pull_request.draft'
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
@@ -87,6 +90,7 @@ jobs:
     runs-on: [self-hosted, nix]
     if: '!github.event.pull_request.draft'
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
@@ -97,6 +101,7 @@ jobs:
     runs-on: [self-hosted, nix]
     if: '!github.event.pull_request.draft'
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
@@ -108,6 +113,7 @@ jobs:
     needs:
       - dev-deps
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
@@ -134,6 +140,7 @@ jobs:
     runs-on: [self-hosted, nix]
     if: '!github.event.pull_request.draft'
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
@@ -149,6 +156,7 @@ jobs:
       - dev-deps
     if: '!github.event.pull_request.draft'
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
@@ -166,6 +174,7 @@ jobs:
       - tests
       - doc
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
@@ -187,6 +196,7 @@ jobs:
       - dev-deps
     if: "!github.event.pull_request.draft && contains(github.event.pull_request.labels.*.name, 'heavy-tests')"
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
@@ -199,6 +209,7 @@ jobs:
       - dev-deps
     if: "!github.event.pull_request.draft && contains(github.event.pull_request.labels.*.name, 'solvers/cadical')"
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
@@ -211,6 +222,7 @@ jobs:
       - dev-deps
     if: "!github.event.pull_request.draft && contains(github.event.pull_request.labels.*.name, 'solvers/kissat')"
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false

.github/workflows/non-linux.yml

@@ -14,6 +14,7 @@ jobs:
     name: 🧪 MacOS workspace tests
     runs-on: macos-latest
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
@@ -25,6 +26,7 @@ jobs:
     name: 🧪 Windows workspace tests
     runs-on: windows-latest
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
@@ -39,6 +41,7 @@ jobs:
         os: [macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false

.github/workflows/pages.yml

@@ -17,6 +17,7 @@ jobs:
   build:
     runs-on: [self-hosted, nix]
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
@@ -35,6 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
       - name: 🫙 Deploy to GitHub Pages
         id: deployment
         uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5

.github/workflows/semver-checks.yml

@@ -10,6 +10,7 @@ jobs:
     name: 🛡️ Semver checks
     runs-on: [self-hosted, nix]
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false