set token perms

Author: NicolasMassart

.github/workflows/latest_publish.yml

@@ -11,6 +11,8 @@ jobs:
     name: Build and publish latest site
     runs-on: ubuntu-latest
     environment: production
+    permissions:
+      contents: read
     # secrets are not usable from outside ConsenSys org
     # The workflow will then be disabled for non ConsenSys repositories to prevent useless failure.
     # Restricting to refs/heads/main here to prevent workflow_dispatch to run on another branch

.github/workflows/linkcheck.yml

@@ -8,6 +8,8 @@ jobs:
     name: Check links
     runs-on: ubuntu-latest
     environment: no-secret
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v2

.github/workflows/lint.yml

@@ -8,6 +8,8 @@ jobs:
     name: Lint Code Base
     runs-on: ubuntu-latest
     environment: no-secret
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v2
         with:

.github/workflows/pr_preview_delete.yml

@@ -10,6 +10,10 @@ jobs:
     name: Remove PR preview from pages
     runs-on: ubuntu-latest
     environment: no-secret
+    permissions:
+      contents: write
+      pull-requests: write
+
     steps:
       - name: 'checkout code from repos'
         uses: actions/checkout@v2

.github/workflows/pr_preview_publish.yml

@@ -8,6 +8,10 @@ jobs:
     name: Build and publish PR preview
     runs-on: ubuntu-latest
     environment: preview
+    permissions:
+      contents: write
+      pull-requests: write
+
     steps:
       - name: checkout code from repos
         uses: actions/checkout@v2

.github/workflows/release_publish.yml

@@ -11,6 +11,8 @@ jobs:
     name: Build and publish released site
     runs-on: ubuntu-latest
     environment: production
+    permissions:
+      contents: read
     # secrets are not usable from outside ConsenSys org
     # The workflow will then be disabled for non ConsenSys repositories to prevent useless failure.
     # Restricting to refs/heads/main here to prevent workflow_dispatch to run on another branch

.github/workflows/spelling.yml

@@ -12,6 +12,8 @@ jobs:
     name: Vale
     runs-on: ubuntu-latest
     environment: no-secret
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v2
       - name: create style dir