chore: Set permissions for GitHub actions (#4732)

.github/workflows/codecoverage.yaml

@@ -8,6 +8,9 @@ on:
     branches:
       - '**'
 
+permissions:
+  contents: read
+
 jobs:
   publish-code-coverage:
     if: ${{ !contains(github.event.head_commit.message, 'coverage skip') }}

.github/workflows/deploy-snapshot.yaml

@@ -5,6 +5,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   gradle:
     runs-on: ubuntu-latest

.github/workflows/deploy-website.yaml

@@ -5,6 +5,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   build-detekt-docs:
     if: github.repository == 'detekt/detekt'
@@ -43,6 +46,8 @@ jobs:
           path: docs/pages/gettingstarted/cli-options.md
 
   build-website:
+    permissions:
+      contents: write  # for JamesIves/github-pages-deploy-action to push changes in repo
     needs: build-detekt-docs
     runs-on: ubuntu-latest
     container: jekyll/builder

.github/workflows/detekt-with-type-resolution.yaml

@@ -11,8 +11,14 @@ on:
 env:
   GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
 
+permissions:
+  contents: read
+
 jobs:
   plain:
+    permissions:
+      contents: read  # for actions/checkout to fetch code
+      security-events: write  # for github/codeql-action/upload-sarif to upload SARIF results
     runs-on: ubuntu-latest
     if: ${{ !contains(github.event.head_commit.message, 'ci skip') }}
     steps:

.github/workflows/fossascan.yaml

@@ -5,6 +5,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   fossa-scan:
     if: ${{ github.repository == 'detekt/detekt' }}

.github/workflows/gradle-wrapper-validation.yml

@@ -7,6 +7,9 @@ on:
     branches:
       - '**'
 
+permissions:
+  contents: read
+
 jobs:
   validation:
     name: Validation

.github/workflows/pre-merge.yaml

@@ -11,6 +11,9 @@ on:
 env:
   GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
 
+permissions:
+  contents: read
+
 jobs:
   gradle:
     if: ${{ !contains(github.event.head_commit.message, 'ci skip') }}