Set minimal permissions to Github Workflows (#3972)

.github/workflows/cifuzz.yml

@@ -1,5 +1,9 @@
 name: CIFuzz
 on: [pull_request]
+
+permissions:
+  contents: read
+
 jobs:
   Fuzzing:
     runs-on: ubuntu-latest

.github/workflows/codeql-analysis.yml

@@ -11,6 +11,9 @@ on:
     - cron: '0 19 * * 1'
   workflow_dispatch:
   
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
   cancel-in-progress: true
@@ -19,6 +22,8 @@ jobs:
   CodeQL-Build:
 
     runs-on: ubuntu-latest
+    permissions:
+      security-events: write
 
     steps:
     - name: Checkout repository

.github/workflows/labeler.yml

@@ -4,6 +4,8 @@ on:
   pull_request_target:
     types: [opened, synchronize]
 
+permissions: {}
+
 jobs:
   label:
     permissions:

.github/workflows/macos.yml

@@ -9,6 +9,9 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
   cancel-in-progress: true

.github/workflows/publish_documentation.yml

@@ -10,6 +10,9 @@ on:
       - docs/examples/**
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 # we don't want to have concurrent jobs, and we don't want to cancel running jobs to avoid broken publications
 concurrency:
   group: documentation

.github/workflows/ubuntu.yml

@@ -9,6 +9,9 @@ on:
   pull_request:
   workflow_dispatch:
   
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
   cancel-in-progress: true
@@ -102,6 +105,9 @@ jobs:
   ci_test_coverage:
     runs-on: ubuntu-latest
     container: ghcr.io/nlohmann/json-ci:v2.4.0
+    permissions:
+      contents: read
+      checks: write
     steps:
       - uses: actions/checkout@v3
       - name: Run CMake

.github/workflows/windows.yml

@@ -9,6 +9,9 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
   cancel-in-progress: true