restrict default GITHUB_TOKEN to read-only in all workflows

Author: hu-ahmed

.github/workflows/docker-nightly.yml

@@ -15,6 +15,9 @@ on:
     - cron: '0 1 * * *' # run at 1 AM UTC
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     if: github.repository == 'eclipse-ditto/ditto'

.github/workflows/gh-pages.yml

@@ -21,6 +21,9 @@ on:
   # Enable manually triggering
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-20.04

.github/workflows/helm-chart-release.yml

@@ -20,6 +20,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/helm-chart.yml

@@ -23,6 +23,9 @@ on:
       - '.github/ct.yml'
       - '.github/kubeval.sh'
 
+permissions:
+  contents: read
+
 jobs:
   lint-chart:
     runs-on: ubuntu-latest

.github/workflows/license-check.yml

@@ -14,6 +14,9 @@ on:
   # Run build for any PR
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   check-license-header-year:
     runs-on: ubuntu-latest

.github/workflows/maven.yml

@@ -28,6 +28,9 @@ on:
       - 'ui/**'
       - 'benchmark-tool/**'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/push-dockerhub-on-demand.yml

@@ -30,6 +30,9 @@ on:
           - ditto-connectivity
           - ditto-ui
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/push-dockerhub.yml

@@ -15,6 +15,9 @@ on:
     tags:
       - '**'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/system-tests.yml

@@ -54,9 +54,16 @@ run-name: >-
   System Tests • ${{ inputs.ditto_repo }}@${{ inputs.ditto_branch }}
   • ${{ inputs.ditto_testing_repo }}@${{ inputs.ditto_testing_branch }}
 
+permissions:
+  contents: read
+
 jobs:
   system-tests:
     runs-on: ditto-runner
+    permissions:
+      contents: read
+      # required by dorny/test-reporter to publish results to the GitHub Checks API
+      checks: write
     env:
       DITTO_BRANCH: ${{ github.event.inputs.ditto_branch }}
       DITTO_REPO: ${{ github.event.inputs.ditto_repo }}

.github/workflows/ui-ci.yml

@@ -21,6 +21,9 @@ on:
     paths:
       - 'ui/**'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest