ci: declare GITHUB_TOKEN permissions for GitHub Actions workflows

.github/workflows/ci.yml

@@ -14,8 +14,9 @@ on:
      - release/**
 
 permissions:
-    contents: read
-    checks: write
+  contents: read
+  checks: write
+  actions: write
 
 jobs:
   build_linux:

.github/workflows/ci_release.yml

@@ -6,6 +6,10 @@ on:
       - "v[0-9]+.[0-9]+.[0-9]+"
       - "v[0-9]+.[0-9]+.[0-9]+-beta.*"
 
+permissions:
+  contents: read
+  actions: write
+
 env:
   ARCHIVE_PREFIX: com.espressif.idf.update-
   ARCHIVE_SUFFIX: -SNAPSHOT.zip

.github/workflows/ci_uploads.yml

@@ -12,6 +12,9 @@ on:
     paths:
       - 'internal/com.espressif.idf.uploads/**'
 
+permissions:
+  contents: read
+
 jobs:
   upload-file:
     runs-on: ubuntu-latest

.github/workflows/ci_windows.yml

@@ -14,8 +14,8 @@ on:
      - release/**
 
 permissions:
-     contents: read
-     checks: write
+  contents: read
+  checks: write
 
 jobs:
   build_windows:

.github/workflows/docs_build.yml

@@ -13,6 +13,10 @@ on:
     - 'docs/**'
     - '.github/workflows/docs_build.yml'
 
+permissions:
+  contents: read
+  actions: write
+
 jobs:
 
   build-docs:

.github/workflows/docs_production.yml

@@ -10,7 +10,10 @@ on:
     paths:
     - 'docs/**'
     - '.github/workflows/docs_production.yml'
-
+
+permissions:
+  contents: read
+
 jobs:
 
   deploy-prod-docs:

.github/workflows/issue_comment.yml

@@ -3,6 +3,10 @@ name: Sync issue comments to JIRA
 # This workflow will be triggered when new issue comment is created (including PR comments)
 on: issue_comment
 
+permissions:
+  contents: read
+  issues: write
+
 jobs:
   sync_issue_comments_to_jira:
     name: Sync Issue Comments to Jira

.github/workflows/new_issues.yml

@@ -5,8 +5,9 @@ on:
     types: [opened, edited]
 
 permissions:
-  issues: write
   contents: read
+  issues: write
+  actions: write
 
 jobs:
   sync_issues_to_jira:

.github/workflows/new_prs.yml

@@ -6,6 +6,10 @@ on:
   schedule:
     - cron: "0 * * * *"
 
+permissions:
+  contents: read
+  issues: write
+
 jobs:
   sync_prs_to_jira:
     name: Sync PRs to Jira

.github/workflows/nightly.yml

@@ -7,6 +7,10 @@ on:
   schedule:
     - cron: "0 0 * * *"
 
+permissions:
+  contents: read
+  actions: write
+
 jobs:
   build:
     runs-on: macos-latest

.github/workflows/pr-comment.yml

@@ -3,6 +3,11 @@ on:
   workflow_run:
     workflows: [CI]
     types: [completed]
+
+permissions:
+  actions: read
+  issues: write
+
 jobs:
   pr_comment:
     if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success'

.github/workflows/pre-commit.yml

@@ -1,8 +1,11 @@
 name: Conventional Commits Check
 
 on:
-    pull_request:
-        branches: [ master ]
+  pull_request:
+    branches: [master]
+
+permissions:
+  contents: read
 
 jobs:
   precommit:

.github/workflows/update-site-test.yml

@@ -14,6 +14,9 @@ on:
     - cron: '0 0 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   update-site-tests:
     runs-on: [self-hosted, eclipse, BrnoUBU0004]