chore: add job-level permissions to workflows

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: ffflorian

.github/workflows/build_test_publish.yml

@@ -5,35 +5,36 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+permissions: {}
 jobs:
   build_test_publish:
     permissions:
       contents: write
     name: Build, test and publish
     runs-on: ubuntu-latest
     steps:
-    - name: Checkout repository
+      - name: Checkout repository
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
       with:
         fetch-depth: 0
 
-    - name: Set up Node.js
+      - name: Set up Node.js
       uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f
       with:
         node-version: 24.x
         cache: yarn
 
-    - name: Install packages
+      - name: Install packages
       run: |
         yarn --immutable
 
-    - name: Lint, build, and test
+      - name: Lint, build, and test
       run: |
         yarn build:ts
         yarn lint
         yarn test
 
-    - name: Release on npm
+      - name: Release on npm
       if: github.event_name != 'pull_request'
       env:
         GIT_AUTHOR_NAME: Florian Imdahl
@@ -47,7 +48,7 @@ jobs:
         set -o pipefail
         yarn release 2>&1 | tee /tmp/release.log
 
-    - name: Upload release log
+      - name: Upload release log
       if: failure()
       uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
       with:

.github/workflows/codeql.yml

@@ -17,8 +17,9 @@ on:
   pull_request:
     branches: ['main']
   schedule:
-    - cron: '17 16 * * 0'
+      - cron: '17 16 * * 0'
 
+permissions: {}
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})

.github/workflows/force-release.yml

@@ -3,16 +3,17 @@ name: Force Release
 on:
   workflow_dispatch:
 
+permissions: {}
 jobs:
   force-release:
     permissions:
       contents: write
     runs-on: ubuntu-latest
     steps:
-    - name: Checkout repository
+      - name: Checkout repository
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
-    - uses: 
+      - uses: 
         ffflorian/actions/force-release@dcf7867b80c82038098ed48c2eaf9944e84a98bb
       with:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/git_mirror.yml

@@ -4,14 +4,15 @@ on:
   push:
     branches: [main]
 
+permissions: {}
 jobs:
   mirror:
     permissions:
       contents: read
       packages: write
     runs-on: ubuntu-latest
     steps:
-    - uses: 
+      - uses: 
         ffflorian/actions/git-mirror@baf8fb2e65ebe6564870f56315a09bc01ab7e0f7
       with:
         GITLAB_REMOTE: 'git@gitlab.com:ffflorian/node-packages.git'

.github/workflows/yarn_update.yml

@@ -5,18 +5,19 @@ on:
   - cron: '0 5 1 * *'
   push:
     branches:
-    - main
+      - main
     paths:
-    - '.github/workflows/yarn_update.yml'
+      - '.github/workflows/yarn_update.yml'
   workflow_dispatch:
 
+permissions: {}
 jobs:
   yarn-update-check:
     permissions:
       contents: read
     runs-on: ubuntu-latest
     steps:
-    - name: Update yarn
+      - name: Update yarn
       uses: 
         ffflorian/actions/yarn-update@baf8fb2e65ebe6564870f56315a09bc01ab7e0f7
       with: