Merge pull request #3232 from jrfnl/feature/ghactions-set-minimal-permissions

GH Actions: set permissions for each workflow/job

.github/workflows/tests.yml

@@ -6,8 +6,7 @@ on:
   # Allow manually triggering the workflow.
   workflow_dispatch:
 
-permissions:
+permissions: {}
-  contents: read # to fetch code (actions/checkout)
 
 jobs:
 
@@ -15,6 +14,9 @@ jobs:
     runs-on: ubuntu-22.04
     name: Coding standards
 
+    permissions:
+      contents: read # to fetch code (actions/checkout)
+
     steps:
       - name: Check out code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -57,6 +59,9 @@ jobs:
     name: "Lint: PHP ${{ matrix.php }}"
     continue-on-error: ${{ matrix.experimental }}
 
+    permissions:
+      contents: read # to fetch code (actions/checkout)
+
     steps:
       - name: Checkout code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -129,6 +134,9 @@ jobs:
 
     continue-on-error: ${{ matrix.experimental }}
 
+    permissions:
+      contents: read # to fetch code (actions/checkout)
+
     steps:
       - name: Check out code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0