[StepSecurity] ci: Harden GitHub Actions (#3378)

Signed-off-by: StepSecurity Bot <[email protected]>
Co-authored-by: Lalit Kumar Bhasin <[email protected]>
Co-authored-by: Marc Alff <[email protected]>

Author: 3 people

.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
 
 # Commented 2024-11-06, lack of workers in github causes CI failures

.github/workflows/clang-tidy.yaml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   clang-tidy:
     runs-on: ubuntu-24.04

.github/workflows/cmake_install.yml

@@ -7,6 +7,9 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   windows_2022_vcpkg_submodule:
     name: Windows 2022 vcpkg submodule versions cxx17 (static libs - dll)

.github/workflows/codeql-analysis.yml

@@ -7,8 +7,15 @@ on:
     # The branches below must be a subset of the branches above
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   CodeQL-Build:
+    permissions:
+      actions: read  # for github/codeql-action/init to get workflow details
+      contents: read  # for actions/checkout to fetch code
+      security-events: write  # for github/codeql-action/autobuild to send a status report
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository

.github/workflows/cppcheck.yml

@@ -7,6 +7,9 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   cppcheck:
     runs-on: ubuntu-24.04

.github/workflows/dependencies_image.yml

@@ -3,6 +3,9 @@ on:
   schedule:
     - cron: "0 3 * * 6"
 
+permissions:
+  contents: read
+
 jobs:
   docker_image:
     name: Docker Image

.github/workflows/project_management_comment.yml

@@ -4,6 +4,9 @@ on:
   issues:
     types:
       - labeled
+permissions:
+  contents: read
+
 jobs:
   add-comment:
     if: github.event.label.name == 'help wanted'