Merge pull request #164 from ToshY/ci/codql-permissions

[ci] using permissions read for workflow actions

Author: ToshY

.github/workflows/generator.yml

@@ -1,9 +1,14 @@
 name: Generator
+
 on:
   workflow_dispatch:
   schedule:
     - cron: '0 0 * * 0'
 
+permissions:
+  contents: write
+  pull-requests: write
+
 env:
   API_SPEC_MANIFEST: https://toshy.github.io/bunnynet-openapi-specification/manifest.json
 

.github/workflows/phpcs.yml

@@ -1,4 +1,5 @@
 name: PHPCS
+
 on:
   push:
     branches:
@@ -7,6 +8,9 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   phpcs:
     name: PHP CS Fixer

.github/workflows/phpmd.yml

@@ -1,4 +1,5 @@
 name: PHPMD
+
 on:
   push:
     branches:
@@ -7,6 +8,9 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   phpmd:
     name: PHPMD

.github/workflows/phpstan.yml

@@ -1,4 +1,5 @@
 name: PHPStan
+
 on:
   push:
     branches:
@@ -7,6 +8,9 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   phpcs:
     name: PHPStan

.github/workflows/phpunit.yml

@@ -1,4 +1,5 @@
 name: PHPUnit
+
 on:
   push:
     branches:
@@ -7,6 +8,9 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   phpcs:
     name: PHPUnit

.github/workflows/security.yml

@@ -1,4 +1,5 @@
 name: Security Check
+
 on:
   push:
     branches:
@@ -9,6 +10,9 @@ on:
   schedule:
     - cron: '0 3 * * 0'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Security check