6707 - Add least-privilege permissions block to PR-triggered workflows

Author: aidangarske

.github/workflows/ada.yml

@@ -7,6 +7,9 @@ on:
     types: [opened, synchronize, reopened, ready_for_review]
     branches: [ '*' ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
 

.github/workflows/aesgcm-siv.yml

@@ -15,6 +15,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:

.github/workflows/arduino.yml

@@ -72,6 +72,9 @@ on:
 concurrency:
   # Same branch push cancels other jobs. Other PR branches untouched
 
+permissions:
+  contents: read
+
   group: ${{ github.workflow }}-${{ github.ref_name }}
   cancel-in-progress: true
 

.github/workflows/async-examples.yml

@@ -11,6 +11,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   async_examples:
     if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}

.github/workflows/async.yml

@@ -16,6 +16,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:

.github/workflows/bind.yml

@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:

.github/workflows/check-cert-chains.yml

@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:

.github/workflows/cmake-autoconf.yml

@@ -7,6 +7,9 @@ on:
     types: [opened, synchronize, reopened, ready_for_review]
     branches: [ '*' ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}

.github/workflows/cmake.yml

@@ -7,6 +7,9 @@ on:
     types: [opened, synchronize, reopened, ready_for_review]
     branches: [ '*' ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}

.github/workflows/codespell.yml

@@ -10,6 +10,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs: