ci: set workflow permissions to read-only by default

.github/workflows/check-linked-issues.yml

@@ -4,9 +4,15 @@ on:
   pull_request_target:
     types: [opened, edited, reopened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   check_pull_requests:
     runs-on: ubuntu-latest
+    permissions:
+        issues: read
+        pull-requests: write
     name: Check linked issues
     steps:
       - uses: nearform-actions/github-action-check-linked-issues@v1

.github/workflows/ci.yml

@@ -1,16 +1,23 @@
 name: CI
 on:
   push:
-    branches: main
+    branches: 
+      - main
   pull_request:
-    branches: main
+    branches: 
+      - main
+
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
+          check-latest: true
           node-version-file: '.nvmrc'
       - run: npm ci
       - run: npm run lint

.github/workflows/notify-release.yml

@@ -5,9 +5,14 @@ on:
     types: [published]
   schedule:
     - cron: '30 8 * * *'
+permissions:
+  contents: read
 jobs:
   setup:
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      contents: read
     steps:
       - name: Notify release
         uses: nearform-actions/github-action-notify-release@v1

.github/workflows/release.yml

@@ -15,9 +15,16 @@ on:
   pull_request:
     types: [closed]
 
+permissions:
+  contents: read
+
 jobs:
   release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
     steps:
       - name: Setting action build runtime
         uses: actions/setup-node@v4