ci: add explicit permissions to GitHub Actions workflows (#42)

Author: adityathebe

.github/workflows/build-and-test.yml

@@ -12,6 +12,9 @@ env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository_owner }}/postgres
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -72,6 +75,9 @@ jobs:
   test:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
     strategy:
       fail-fast: false # Don't cancel other tests if one fails
       matrix:

.github/workflows/helm.yml

@@ -21,6 +21,9 @@ env:
   REGISTRY: ghcr.io
   HELM_REGISTRY: oci://ghcr.io/flanksource/charts
 
+permissions:
+  contents: read
+
 jobs:
   lint-and-test:
     runs-on: ubuntu-latest
@@ -91,6 +94,9 @@ jobs:
 
   security-scan:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/release.yml

@@ -17,6 +17,9 @@ env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository_owner }}/postgres
 
+permissions:
+  contents: read
+
 jobs:
   determine-version:
     runs-on: ubuntu-latest

.github/workflows/test.yml

@@ -14,6 +14,9 @@ env:
   TEST_USER: testuser
   TEST_PASSWORD: testpass123
 
+permissions:
+  contents: read
+
 jobs:
   test-env-variables:
     runs-on: ubuntu-latest