Merge pull request #788 from CycloneDX/chore/gh-workflow-permissions

chore: GH workflow permissions

Author: jkowalleck

.github/workflows/deploy_cargo_cyclonedx.yml

@@ -5,6 +5,9 @@ on:
     tags:
       - 'cargo-cyclonedx-[0-9]+.[0-9]+.[0-9]+*'
 
+# see https://docs.github.com/en/actions/how-tos/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions: {}
+
 jobs:
   deploy:
     runs-on: ubuntu-latest

.github/workflows/deploy_cyclonedx_bom.yml

@@ -5,6 +5,9 @@ on:
     tags:
       - 'cyclonedx-bom-[0-9]+.[0-9]+.[0-9]+*'
 
+# see https://docs.github.com/en/actions/how-tos/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions: {}
+
 jobs:
   deploy:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -14,10 +14,9 @@
 # title/body based on your changelogs.
 
 name: Release
-permissions:
-  "attestations": "write"
-  "contents": "write"
-  "id-token": "write"
+
+# see https://docs.github.com/en/actions/how-tos/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions: {}
 
 # This task will run whenever you push a git tag that looks like a version
 # like "1.0.0", "v0.1.0-prerelease.1", "my-app/0.1.0", "releases/v1.0.0", etc.
@@ -113,6 +112,10 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       BUILD_MANIFEST_NAME: target/distrib/${{ join(matrix.targets, '-') }}-dist-manifest.json
+    permissions:
+      contents: read 
+      attestations: write  # needed for attestation provenance
+      id-token: write  # needed for attestation provenance
     steps:
       - name: enable windows longpaths
         run: |
@@ -178,6 +181,10 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json
+    permissions:
+      contents: read 
+      attestations: write  # needed for attestation provenance
+      id-token: write  # needed for attestation provenance
     steps:
       - uses: actions/checkout@v4
         with:
@@ -227,6 +234,8 @@ jobs:
     runs-on: "ubuntu-20.04"
     outputs:
       val: ${{ steps.host.outputs.manifest }}
+    permissions:
+      contents: write  # needed for creating GH releases
     steps:
       - uses: actions/checkout@v4
         with:

.github/workflows/rust.yml

@@ -6,6 +6,9 @@ on:
     branches:
       - "main"
 
+# see https://docs.github.com/en/actions/how-tos/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions: {}
+
 jobs:
   lint:
     name: Linting & Coding Standards