Merge pull request #5798 from boahc077/github_actions_token_permission

ci: add minimum GitHub token permissions for workflows

.github/workflows/build.yml

@@ -2,6 +2,9 @@ name: Build & Test
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   Ubuntu-1804-gcc:
     runs-on: ubuntu-18.04

.github/workflows/codeql-analysis.yml

@@ -8,8 +8,15 @@ on:
   schedule:
     - cron: '0 19 * * 4'
 
+permissions:
+  contents: read
+
 jobs:
   CodeQL-Build:
+    permissions:
+      actions: read  # for github/codeql-action/init to get workflow details
+      contents: read  # for actions/checkout to fetch code
+      security-events: write  # for github/codeql-action/autobuild to send a status report
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository

.github/workflows/lint.yml

@@ -2,6 +2,9 @@ name: Lint
 
 on: [pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   misspell:
     name: Check spelling with misspell

.github/workflows/oss-fuzz.yml

@@ -1,5 +1,8 @@
 name: CIFuzz
 on: [pull_request]
+permissions:
+  contents: read
+
 jobs:
   Fuzzing:
     runs-on: ubuntu-latest

.github/workflows/super-linter.yml

@@ -2,8 +2,14 @@ name: Super-Linter
 
 on: [pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
+    permissions:
+      contents: read  # for actions/checkout to fetch code
+      statuses: write  # for github/super-linter/slim to mark status of each linter run
     name: Lint Code Base
     runs-on: ubuntu-latest
     steps: