fix: reduce token permissions (#7719)

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

.github/workflows/check-actions.yaml

@@ -14,8 +14,6 @@ permissions: {}
 jobs:
   check:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3

.github/workflows/cli.yaml

@@ -10,13 +10,12 @@ on:
       - 'main'
       - 'release*'
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
-
 jobs:
   cli-test:
     runs-on: ubuntu-latest

.github/workflows/codecov.yaml

@@ -9,13 +9,12 @@ on:
       - 'main'
       - 'release*'
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
-
 jobs:
   codecov:
     runs-on: ubuntu-latest

.github/workflows/comment-commands.yaml

@@ -6,13 +6,14 @@ on:
       - created
       - edited
 
-permissions:
-  issues: write
-  pull-requests: write
+permissions: {}
 
 jobs:
   execute:
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
       - uses: jpmcb/prow-github-actions@f4d01dd4b13f289014c23fe5a19878a2479cb35b # v1.1.3
         with:

.github/workflows/fossa.yml

@@ -5,8 +5,7 @@ on:
     branches: 
       - main
 
-permissions:
-  contents: read
+permissions: {}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -15,6 +14,8 @@ concurrency:
 jobs:
   fossa-scan:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3

.github/workflows/images-build.yaml

@@ -9,12 +9,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions: 
-  contents: read
+permissions: {}
 
 jobs:
   build-images:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3