Merge pull request #124 from marquiz/devel/github-permissions

github: add top level default permissions to workflows

.github/workflows/common-codeql.yaml

@@ -7,6 +7,10 @@ on:
         required: false
         type: boolean
 
+permissions:
+  contents: read
+  security-events: write
+
 jobs:
   codeql-scan:
     runs-on: ubuntu-22.04

.github/workflows/common-trivy.yaml

@@ -10,6 +10,11 @@ on:
         default: false
         required: false
         type: boolean
+
+permissions:
+  contents: read
+  security-events: write
+
 jobs:
   trivy-scan-licenses:
     runs-on: ubuntu-22.04

.github/workflows/release.yaml

@@ -4,6 +4,10 @@ on:
   push:
     tags: [ 'v*' ]
 
+permissions:
+  contents: read
+  security-events: write
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref_name }}
   cancel-in-progress: true

.github/workflows/verify.yaml

@@ -5,9 +5,15 @@ on:
   pull_request:
     paths-ignore:
       - "**.md"
+
+permissions:
+  contents: read
+  security-events: write
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
 jobs:
   test-and-lint:
     runs-on: ubuntu-22.04