Add minimum token permissions to all GitHub workflow files

Co-authored-by: trask <218610+trask@users.noreply.github.com>

Author: Copilot

.github/workflows/backport.yml

@@ -6,9 +6,15 @@ on:
         description: "The pull request # to backport"
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   backport:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # needed for creating branches and pull requests
+      pull-requests: write # needed for creating pull requests
     steps:
       - run: |
           if [[ ! $GITHUB_REF_NAME =~ ^release/v[0-9]+\.[0-9]+\.x-0\.[0-9]+bx$ ]]; then

.github/workflows/benchmarks.yml

@@ -4,9 +4,14 @@ on:
   push:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   sdk-benchmarks:
     runs-on: equinix-bare-metal
+    permissions:
+      contents: write # needed for benchmark-action/github-action-benchmark to push to gh-pages
     steps:
     - name: Checkout Core Repo @ SHA - ${{ github.sha }}
       uses: actions/checkout@v4

.github/workflows/changelog.yml

@@ -1,7 +1,3 @@
-# This action requires that any PR targeting the main branch should touch at
-# least one CHANGELOG file. If a CHANGELOG entry is not required, add the "Skip
-# Changelog" label to disable this action.
-
 name: changelog
 
 on:
@@ -10,6 +6,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   changelog:
     runs-on: ubuntu-latest

.github/workflows/check-links.yml

@@ -4,6 +4,9 @@ on:
     branches: [ main ]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   changedfiles:
     name: changed files

.github/workflows/codeql-analysis.yml

@@ -14,10 +14,14 @@ on:
     #        *  * * * *
     - cron: '30 1 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   CodeQL-Build:
     runs-on: ubuntu-latest
-
+    permissions:
+      security-events: write # needed for github/codeql-action
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4

.github/workflows/contrib.yml

@@ -6,6 +6,9 @@ on:
     - 'release/*'
   pull_request:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true

.github/workflows/lint_0.yml

@@ -9,6 +9,9 @@ on:
     - 'release/*'
   pull_request:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true

.github/workflows/misc_0.yml

@@ -9,6 +9,9 @@ on:
     - 'release/*'
   pull_request:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true

.github/workflows/prepare-patch-release.yml

@@ -2,9 +2,15 @@ name: Prepare patch release
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   prepare-patch-release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # needed for creating branches and pull requests
+      pull-requests: write # needed for creating pull requests
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/prepare-release-branch.yml

@@ -6,6 +6,9 @@ on:
         description: "Pre-release version number? (e.g. 1.9.0rc2)"
         required: false
 
+permissions:
+  contents: read
+
 jobs:
   prereqs:
     runs-on: ubuntu-latest
@@ -41,6 +44,9 @@ jobs:
   create-pull-request-against-release-branch:
     runs-on: ubuntu-latest
     needs: prereqs
+    permissions:
+      contents: write # needed for creating branches and pull requests
+      pull-requests: write # needed for creating pull requests
     steps:
       - uses: actions/checkout@v4
 
@@ -117,6 +123,9 @@ jobs:
   create-pull-request-against-main:
     runs-on: ubuntu-latest
     needs: prereqs
+    permissions:
+      contents: write # needed for creating branches and pull requests
+      pull-requests: write # needed for creating pull requests
     steps:
       - uses: actions/checkout@v4