github-ci: set workflow permissions to read-all

diff --git a/.github/workflows/builds.yml b/.github/workflows/builds.yml
index a6aa20417a03898cca8039ebeb77fe4d5be4eda9..1a53c10640ae1bea1adf4b2a17000d746f85d34f 100644 (file)
--- a/.github/workflows/builds.yml
+++ b/.github/workflows/builds.yml
@@ -4,6 +4,8 @@ on:
   - push
   - pull_request
 
+permissions: read-all
+
 env:
   DEFAULT_LIBHTP_REPO: https://github.com/OISF/libhtp
   DEFAULT_LIBHTP_BRANCH: 0.5.x

diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
index f779ed32c73e1a7a58d1adc9b6383700eda888d6..9010c237e024492215393d69207be332b97988e6 100644 (file)
--- a/.github/workflows/cifuzz.yml
+++ b/.github/workflows/cifuzz.yml
@@ -1,5 +1,6 @@
 name: CIFuzz
 on: [pull_request]
+permissions: read-all
 jobs:
  Fuzzing:
    runs-on: ubuntu-latest

diff --git a/.github/workflows/commits.yml b/.github/workflows/commits.yml
index 651cacfa9577bdd68c227feb61dd8e582a6a1995..fac19f9966aae80171d009bbad37cd79710d600d 100644 (file)
--- a/.github/workflows/commits.yml
+++ b/.github/workflows/commits.yml
@@ -3,6 +3,8 @@ name: commit-check
 on:
   - pull_request
 
+permissions: read-all
+
 jobs:
 
   check-commits:

diff --git a/.github/workflows/formatting.yml b/.github/workflows/formatting.yml
index e77389511b8d03414d703467538f47b6d68776d1..b1c040058f4197a1fa54c18721b24bddac7ee646 100644 (file)
--- a/.github/workflows/formatting.yml
+++ b/.github/workflows/formatting.yml
@@ -8,6 +8,8 @@ on:
       - 'master-*'
   pull_request:
 
+permissions: read-all
+
 jobs:
 
   # Checking for correct formatting of branch for C code changes