Restrict github action workflow permissions (#647)

Signed-off-by: jsetton <[email protected]>

.github/workflows/ci.yml

@@ -8,6 +8,9 @@ on:
     branches: [ main ]
     paths: [ 'lambda/**' ]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Testing

.github/workflows/deployment.yml

@@ -4,6 +4,9 @@ on:
   release:
     types: [ published ]
 
+permissions:
+  contents: read
+
 jobs:
   docs:
     name: Documentation Deployment

.github/workflows/documentation.yml

@@ -8,6 +8,9 @@ on:
     branches: [ main ]
     paths: [ '**.md' ]
 
+permissions:
+  contents: read
+
 jobs:
   markdown:
     name: Markdown Linting

.github/workflows/localization.yml

@@ -5,11 +5,17 @@ on:
     branches: [ main ]
     paths: [ 'resources/locales/**' ]
 
+permissions:
+  contents: read
+
 jobs:
   update:
     name: Locale Updates
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: write
+
     steps:
     - name: Checkout repository
       uses: actions/checkout@v4

.github/workflows/release.yml

@@ -10,6 +10,9 @@ on:
         type: choice
         options: [ major, minor, patch, premajor, preminor, prepatch, prerelease ]
 
+permissions:
+  contents: read
+
 jobs:
   pkg-update:
     name: Package Version Update

.github/workflows/security.yml

@@ -8,11 +8,17 @@ on:
   schedule:
     - cron: '42 1 1 * *' # Every first day of the month at 1:42
 
+permissions:
+  contents: read
+
 jobs:
   codeql:
     name: Code Scanning
     runs-on: ubuntu-latest
 
+    permissions:
+      security-events: write
+
     steps:
     - name: Checkout repository
       uses: actions/checkout@v4