Merge pull request #6439 from mempool/knorrium/workflow_permissions

Set explicit read permissions to all workflows

.github/workflows/backend-integration.yml

@@ -7,6 +7,9 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   backend-integration:
     if: "(github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ops') && !contains(github.head_ref, 'ops/')) || github.event_name == 'push'"

.github/workflows/ci.yml

@@ -7,6 +7,9 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   backend:
     if: "(github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ops') && !contains(github.head_ref, 'ops/')) || github.event_name == 'push'"

.github/workflows/e2e_parameterized.yml

@@ -17,7 +17,10 @@ on:
         description: 'Liquid Hostname'
         required: true
         default: 'liquid.network'
-        type: string 
+        type: string
+
+permissions:
+  contents: read
 
 jobs:
   cache:

.github/workflows/get_backend_block_height.yml

@@ -2,6 +2,9 @@ name: 'Check if servers are in sync'
 
 on: [workflow_dispatch]
 
+permissions:
+  contents: read
+
 jobs:
   print-backend-sha:
     runs-on: mempool-ci

.github/workflows/get_backend_hash.yml

@@ -2,6 +2,9 @@ name: 'Print backend hashes'
 
 on: [workflow_dispatch]
 
+permissions:
+  contents: read
+
 jobs:
   print-backend-sha:
     runs-on: mempool-ci

.github/workflows/get_image_digest.yml

@@ -7,7 +7,11 @@ on:
         description: 'Image Version'
         required: false
         default: 'latest'
-        type: string 
+        type: string
+
+permissions:
+  contents: read
+
 jobs:
   print-images-sha:
     runs-on: mempool-ci

.github/workflows/project-review-status.yml

@@ -6,6 +6,9 @@ on:
   issues:
     types: [opened]
 
+permissions:
+  contents: read
+
 jobs:
   project-automation:
     uses: mempool/.github/.github/workflows/project-board-automation.yml@master

.github/workflows/supply-chain-audit.yml

@@ -7,6 +7,9 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   backend:
     if: "(github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ops') && !contains(github.head_ref, 'ops/')) || github.event_name == 'push'"