Add explicit permissions on all jobs

Signed-off-by: Caleb Xu <caxu@redhat.com>

Author: caxu-rh

.github/workflows/build-main.yml

@@ -6,10 +6,14 @@ on:
 
 env:
   IMAGE_NAME: preflight-trigger
-  
+
+permissions: {}
+
 jobs:
   build-main:
     name: Build and push main snapshot images
+    permissions:
+      contents: read
     strategy: 
       matrix:
         architecture: [amd64]
@@ -68,6 +72,8 @@ jobs:
       imageVersion: ${{ env.SHA_SHORT }}
 
   build-coverage:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

.github/workflows/build-release.yml

@@ -10,9 +10,13 @@ on:
 env:
   IMAGE_NAME: preflight-trigger
 
+permissions: {}
+
 jobs:
   build-release:
     name: Build and push tag images
+    permissions:
+      contents: read
     strategy: 
       matrix:
         architecture: [amd64]

.github/workflows/go.yml

@@ -6,8 +6,12 @@ on:
     - main
     - release-*
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3