github-ci: apply read-only permissions to more workflows

- authors.yml
- codeql.yml
- scan-build.yml

diff --git a/.github/workflows/authors.yml b/.github/workflows/authors.yml
index 77bb2614de2409559d7046f537131f9ae1261994..e4b0c563c7c3b7876dd93ccda89c28526bf3594d 100644 (file)
--- a/.github/workflows/authors.yml
+++ b/.github/workflows/authors.yml
@@ -3,6 +3,8 @@ name: New Authors Check
 on:
   pull_request:
 
+permissions: read-all
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e7fc1e43c06af2ee92a7735b484a346802f65d79..d62339a483990e64a5d432a70f0d1b65e883a330 100644 (file)
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -13,6 +13,8 @@ on:
   schedule:
     - cron: '18 21 * * 1'
 
+permissions: read-all
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

diff --git a/.github/workflows/scan-build.yml b/.github/workflows/scan-build.yml
index f0df97e7c80e82485b8488ae2f843faa0c6d15ba..966139d10a578f027dad955d24a411adc0b81980 100644 (file)
--- a/.github/workflows/scan-build.yml
+++ b/.github/workflows/scan-build.yml
@@ -8,6 +8,8 @@ on:
     paths-ignore:
       - "doc/**"
 
+permissions: read-all
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true