ci: restrict permissions of the github actions

Relate to #1154

Author: php-coder

Diff for: .github/workflows/dependencies-diff.yml

@@ -11,6 +11,10 @@ on:
       - src/main/scripts/show-spring-boot-version-diff.sh
       - .github/workflows/dependencies-diff.yml
 
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: read # for "git clone"
+
 defaults:
   # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#defaultsrun
   run:

Diff for: .github/workflows/integration-tests.yml

@@ -4,6 +4,12 @@ on:
   push:
   pull_request:
 
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  # NOTE: actions/upload-artifact makes no use of permissions
+  # See https://github.com/actions/upload-artifact/issues/197#issuecomment-832279436
+  contents: read # for "git clone"
+
 defaults:
   # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#defaultsrun
   run:

Diff for: .github/workflows/static-analysis.yml

@@ -4,6 +4,10 @@ on:
   push:
   pull_request:
 
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: read # for "git clone"
+
 defaults:
   # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#defaultsrun
   run:

Diff for: .github/workflows/unit-tests.yml

@@ -4,6 +4,10 @@ on:
   push:
   pull_request:
 
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: read # for "git clone"
+
 defaults:
   # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#defaultsrun
   run: