Harden GitHub Actions: pin actions to SHAs and set explicit permissions (#4965) (#4975)

(cherry picked from commit 0722f84)

Co-authored-by: cbruno10 <cody@turbot.com>

Author: kaidaguerre

.github/workflows/01-steampipe-release.yaml

@@ -21,6 +21,9 @@ on:
         required: true
         type: boolean
 
+permissions:
+  contents: write
+
 env:
   # Version number from user input, used throughout the workflow for tagging, branching, and release operations
   VERSION: ${{ github.event.inputs.version }}

.github/workflows/02-steampipe-db-image-build.yaml

@@ -16,6 +16,10 @@ on:
         required: true
         default: 14.19.0
 
+permissions:
+  contents: read
+  packages: write
+
 env:
   PROJECT_ID: steampipe
   IMAGE_NAME: db

.github/workflows/10-test-lint.yaml

@@ -9,6 +9,9 @@ on:
   workflow_dispatch:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   golangci:
     name: Test Linting

.github/workflows/11-test-acceptance.yaml

@@ -2,6 +2,9 @@ name: "11 - Test: Acceptance"
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 env:
   STEAMPIPE_UPDATE_CHECK: false
   SPIPETOOLS_PG_CONN_STRING: ${{ secrets.SPIPETOOLS_PG_CONN_STRING }}

.github/workflows/12-test-post-release-linux-distros.yaml

@@ -8,6 +8,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 env:
   # Version from input, used to download the correct release artifacts
   VERSION: ${{ github.event.inputs.version }}

.github/workflows/30-stale.yaml

@@ -10,6 +10,11 @@ on:
         default: "false"
         type: string
 
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
 jobs:
   stale:
     runs-on: ubuntu-latest

.github/workflows/31-add-issues-to-pipeling-issue-tracker.yaml

@@ -4,6 +4,9 @@ on:
   issues:
     types: [opened]
 
+permissions:
+  contents: read
+
 jobs:
   add-to-project:
     uses: turbot/steampipe-workflows/.github/workflows/assign-issue-to-pipeling-issue-tracker.yml@main