ci: use permissionless runner token by default

Runner token permissions should be explicitly declared at the job-level

Signed-off-by: Seth Flynn <getchoo@tuta.io>

.github/workflows/backport.yml

@@ -8,8 +8,7 @@ on:
 # the GitHub repository. This means that it should not evaluate user input in a
 # way that allows code injection.
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   backport:

.github/workflows/build.yml

@@ -72,6 +72,8 @@ on:
         type: string
         default: Debug
 
+permissions: {}
+
 jobs:
   build:
     name: Build (${{ matrix.artifact-name }})
@@ -79,6 +81,7 @@ jobs:
     environment: ${{ inputs.environment || '' }}
 
     permissions:
+      contents: read
       # Required for Azure Trusted Signing
       id-token: write
       # Required for vcpkg binary cache

.github/workflows/nix.yml

@@ -66,8 +66,7 @@ on:
       - ".github/workflows/nix.yml"
   workflow_dispatch:
 
-permissions:
-  contents: read
+permissions: {}
 
 env:
   DEBUG: ${{ github.ref_type != 'tag' }}
@@ -76,6 +75,9 @@ jobs:
   build:
     name: Build (${{ matrix.system }})
 
+    permissions:
+      contents: read
+
     strategy:
       fail-fast: false
       matrix:

.github/workflows/publish.yml

@@ -4,13 +4,15 @@ on:
   release:
     types: [ released ]
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   winget:
     name: Winget
 
+    permissions:
+      contents: read
+
     runs-on: ubuntu-slim
 
     steps:

.github/workflows/release.yml

@@ -5,10 +5,18 @@ on:
     tags:
       - "*"
 
+permissions: {}
+
 jobs:
   build_release:
     name: Build Release
     uses: ./.github/workflows/build.yml
+    permissions:
+      contents: read
+      # Required for Azure Trusted Signing
+      id-token: write
+      # Required for vcpkg binary cache
+      packages: write
     with:
       build-type: Release
       environment: Release
@@ -16,6 +24,8 @@ jobs:
 
   create_release:
     needs: build_release
+    permissions:
+      contents: write
     runs-on: ubuntu-slim
     outputs:
       upload_url: ${{ steps.create_release.outputs.upload_url }}

.github/workflows/stale.yml

@@ -6,6 +6,8 @@ on:
     - cron: "0 0 * * 0"
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   label:
     name: Label issues and PRs

.github/workflows/update-flake.yml

@@ -6,13 +6,16 @@ on:
     - cron: "0 0 * * 0"
   workflow_dispatch:
 
-permissions:
-  contents: write
-  pull-requests: write
+permissions: {}
 
 jobs:
   update-flake:
     if: github.repository == 'PrismLauncher/PrismLauncher'
+
+    permissions:
+      contents: write
+      pull-requests: write
+
     runs-on: ubuntu-slim
 
     steps: