fix: attempt fix token permissions (#1155)

## Description
Resolve Code Scanning Token Permissions issues

## Related Issue

Fixes #978 

## Type of change

- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Other (security config, docs update, etc)


## Checklist before merging

- [x] Test, docs, adr added or updated as needed
- [x] [Contributor
Guide](https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md)
followed

.github/workflows/checkpoint.yaml

@@ -3,6 +3,12 @@
 
 name: Checkpoint UDS Core
 
+# Permissions for the GITHUB_TOKEN used by the workflow.
+permissions:
+  contents: read # Allows reading the content of the repository.
+  packages: read # Allows reading the content of the repository's packages.
+  id-token: write
+
 on:
   pull_request:
     # milestoned is added here as a workaround for release-please not triggering PR workflows (PRs should be added to a milestone to trigger the workflow).

.github/workflows/commitlint.yaml

@@ -3,6 +3,10 @@
 
 name: Metadata
 
+# Permissions for the GITHUB_TOKEN used by the workflow.
+permissions:
+  contents: read # Allows reading the content of the repository.
+
 on:
   pull_request:
     branches: [main]

.github/workflows/docs-shim.yaml

@@ -3,6 +3,10 @@
 
 name: CI Docs
 
+# Permissions for the GITHUB_TOKEN used by the workflow.
+permissions:
+  contents: read # Allows reading the content of the repository.
+
 on:
   pull_request:
     # milestoned is added here as a workaround for release-please not triggering PR workflows (PRs should be added to a milestone to trigger the workflow).

.github/workflows/publish.yaml

@@ -3,6 +3,12 @@
 
 name: Publish UDS Core
 
+# Permissions for the GITHUB_TOKEN used by the workflow.
+permissions:
+  contents: read # Allows reading the content of the repository.
+  packages: read # Allows reading the content of the repository's packages.
+  id-token: write
+
 on:
   # triggered by tag-and-release.yaml and snapshot-release.yaml
   workflow_call:

.github/workflows/snapshot-release.yaml

@@ -3,6 +3,12 @@
 
 name: Release UDS Core Snapshot
 
+# Permissions for the GITHUB_TOKEN used by the workflow.
+permissions:
+  contents: read # Allows reading the content of the repository.
+  packages: read # Allows reading the content of the repository's packages.
+  id-token: write
+
 on:
   schedule:
     - cron: "0 10 * * *"

.github/workflows/tag-and-release.yaml

@@ -3,6 +3,12 @@
 
 name: Release UDS Core
 
+# Permissions for the GITHUB_TOKEN used by the workflow.
+permissions:
+  contents: read # Allows reading the content of the repository.
+  packages: read # Allows reading the content of the repository's packages.
+  id-token: write
+
 on:
   push:
     branches:

.github/workflows/test-shim.yaml

@@ -3,6 +3,10 @@
 
 name: Test Shim
 
+# Permissions for the GITHUB_TOKEN used by the workflow.
+permissions:
+  contents: read # Allows reading the content of the repository.
+
 on:
   # Manual trigger
   workflow_dispatch: