chore(ci): declare least-privilege permissions for GITHUB_TOKEN

.github/workflows/linting-and-checks.yaml

@@ -9,6 +9,9 @@ on:
         description: "Secret to authenticate if using an other container registry than Github"
         required: false
 
+permissions:
+  contents: read
+
 env:
   IMAGE_REGISTRY: ghcr.io
   REGISTRY_USER: $GITHUB_ACTOR

.github/workflows/on-pull-request.yaml

@@ -3,11 +3,17 @@ on:
   pull_request:
     types: [opened, reopened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   linting-and-checks:
     name: "Linting and checks"
     uses: ./.github/workflows/linting-and-checks.yaml
 
   tests:
     name: "Tests"
+    permissions:
+      contents: read
+      packages: read
     uses: ./.github/workflows/tests.yaml

.github/workflows/on-push-main-branch.yaml

@@ -5,23 +5,34 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   linting-and-checks:
     name: "Linting and checks"
     uses: ./.github/workflows/linting-and-checks.yaml
 
   tests:
     name: "Tests"
+    permissions:
+      contents: read
+      packages: read
     uses: ./.github/workflows/tests.yaml
 
   docs:
     needs: tests
     name: "Build and publish docs"
+    permissions:
+      contents: write
     uses: ./.github/workflows/publish-docs.yaml
 
   publish-latest:
     needs: tests
     name: "Publish dev docker images"
+    permissions:
+      contents: read
+      packages: write
     uses: ./.github/workflows/publish-image.yaml
     with:
       image-tags: latest
@@ -46,6 +57,9 @@ jobs:
     needs: release-please
     if: ${{ needs.release-please.outputs.release_created == 'true' }}
     name: "Publish staging docker images"
+    permissions:
+      contents: read
+      packages: write
     uses: ./.github/workflows/publish-image.yaml
     with:
       image-tags: ${{ needs.release-please.outputs.tag_name }}

.github/workflows/publish-docs.yaml

@@ -4,6 +4,9 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: write
+
 env:
   GITHUB_PAGES_BRANCH: gh-pages
 

.github/workflows/publish-image.yaml

@@ -12,6 +12,10 @@ on:
         description: "Secret to authenticate if using an other container registry than Github"
         required: false
 
+permissions:
+  contents: read
+  packages: write
+
 env:
   API_IMAGE: ghcr.io/equinor/template-fastapi-react/api
   NGINX_IMAGE: ghcr.io/equinor/template-fastapi-react/nginx

.github/workflows/release-please.yaml

@@ -10,6 +10,9 @@ on:
         description: "The released tag. Ex 'v1.2.3'"
         value: ${{ jobs.release-please.outputs.tag_name }}
 
+permissions:
+  contents: read
+
 jobs:
   release-please:
     runs-on: ubuntu-latest

.github/workflows/tests.yaml

@@ -9,6 +9,10 @@ on:
         description: "Secret to authenticate if using an other container registry than Github"
         required: false
 
+permissions:
+  contents: read
+  packages: read
+
 env:
   API_IMAGE: ghcr.io/equinor/template-fastapi-react/api
   WEB_IMAGE: ghcr.io/equinor/template-fastapi-react/web