ci: update workflow permissions

Signed-off-by: Matthew Penner <[email protected]>

.github/workflows/build.yaml

@@ -14,6 +14,8 @@ jobs:
   ui:
     name: UI
     runs-on: ubuntu-20.04
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:

.github/workflows/ci.yaml

@@ -14,6 +14,8 @@ jobs:
   tests:
     name: Tests
     runs-on: ubuntu-20.04
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:

.github/workflows/docker.yaml

@@ -18,6 +18,9 @@ jobs:
     name: Push
     runs-on: ubuntu-20.04
     if: "!contains(github.ref, 'develop') || (!contains(github.event.head_commit.message, 'skip docker') && !contains(github.event.head_commit.message, 'docker skip'))"
+    permissions:
+      contents: read
+      packages: write
     steps:
       - name: Code checkout
         uses: actions/checkout@v3

.github/workflows/lint.yaml

@@ -14,6 +14,8 @@ jobs:
   lint:
     name: Lint
     runs-on: ubuntu-20.04
+    permissions:
+      contents: read
     steps:
       - name: Code Checkout
         uses: actions/checkout@v3

.github/workflows/release.yaml

@@ -9,6 +9,8 @@ jobs:
   release:
     name: Release
     runs-on: ubuntu-20.04
+    permissions:
+      contents: write # write is required to create releases and push.
     steps:
       - name: Code checkout
         uses: actions/checkout@v3
@@ -41,7 +43,7 @@ jobs:
 
       - name: Create release archive
         run: |
-          rm -rf node_modules tests CODE_OF_CONDUCT.md CONTRIBUTING.md flake.lock flake.nix phpunit.xml shell.nix 
+          rm -rf node_modules tests CODE_OF_CONDUCT.md CONTRIBUTING.md flake.lock flake.nix phpunit.xml shell.nix
           tar -czf panel.tar.gz * .editorconfig .env.example .eslintignore .eslintrc.js .gitignore .prettierrc.json
 
       - name: Extract changelog