chore(ci): add explicit permissions: blocks to all workflows (#23977)

Author: netroms

.github/workflows/analyse-pr.yml

@@ -33,6 +33,9 @@ on:
 concurrency:
   group: ${{ github.workflow}}-${{ github.ref }}
   cancel-in-progress: true
+permissions:
+  contents: read
+
 jobs:
   sonarqube:
     if: github.actor != 'dependabot[bot]'

.github/workflows/check-formatting.yml

@@ -5,6 +5,9 @@ env:
 
 on: [ pull_request ]
 
+permissions:
+  contents: read
+
 jobs:
   check-formatting:
     runs-on: ubuntu-latest

.github/workflows/deploy-instance.yml

@@ -9,6 +9,11 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  checks: read           # for t3chguy/wait-on-check-action
+  pull-requests: write   # for actions-cool/maintain-one-comment
+
 jobs:
   deploy-instance:
     if: contains(github.event.pull_request.labels.*.name, 'deploy')

.github/workflows/destroy-instance.yml

@@ -9,6 +9,11 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  pull-requests: write   # for actions-cool/maintain-one-comment delete
+  issues: read           # for gh api issues/<n>/events
+
 jobs:
   check-deploy-label:
     runs-on: ubuntu-latest

.github/workflows/generate-merge-boms.yml

@@ -8,6 +8,9 @@ concurrency:
   group: ${{ github.workflow}}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   create-boms:
     runs-on: ubuntu-latest

.github/workflows/performance-tests-compare.yml

@@ -109,6 +109,9 @@ on:
         type: string
         default: manual
 
+permissions:
+  contents: read
+
 jobs:
   performance-tests:
     if: github.repository == 'dhis2/dhis2-core'

.github/workflows/performance-tests-scheduled.yml

@@ -11,6 +11,9 @@ on:
     # Run at 1 AM UTC every day
     - cron: "0 1 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   run-scheduled-tests:
     name: ${{ matrix.name }}

.github/workflows/performance-tests.yml

@@ -84,6 +84,9 @@ on:
         description: 'Slack webhook URL for failure notifications'
         required: false
 
+permissions:
+  contents: read
+
 jobs:
   performance-tests:
     if: github.repository == 'dhis2/dhis2-core'

.github/workflows/run-api-analytics-tests-clickhouse.yml

@@ -24,6 +24,9 @@ on:
 concurrency:
   group: ${{ github.workflow}}-${{ github.ref }}
   cancel-in-progress: true
+permissions:
+  contents: read
+
 jobs:
   api-analytics-test-clickhouse:
     env:

.github/workflows/run-api-analytics-tests-doris.yml

@@ -26,6 +26,9 @@ on:
 concurrency:
   group: ${{ github.workflow}}-${{ github.ref }}
   cancel-in-progress: true
+permissions:
+  contents: read
+
 jobs:
   api-analytics-test-doris:
     env: