GitHub Workflows security hardening (#3624)

* build: harden build.yaml permissions

Signed-off-by: Alex <aleksandrosansan@gmail.com>

* build: harden trigger-skeletons.yml permissions

Signed-off-by: Alex <aleksandrosansan@gmail.com>

* build: harden tests.yaml permissions

Signed-off-by: Alex <aleksandrosansan@gmail.com>

Signed-off-by: Alex <aleksandrosansan@gmail.com>

.github/workflows/build.yaml

@@ -4,8 +4,13 @@ on:
   release:
     types: [published]
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: write # for release creation (svenstaro/upload-release-action)
+
     if: "!github.event.release.prerelease"
     runs-on: ubuntu-latest
 
@@ -52,6 +57,9 @@ jobs:
           file_glob: true
 
   slack:
+    permissions:
+      actions: read # to list jobs for workflow run (technote-space/workflow-conclusion-action)
+
     name: Slack
     needs: build
     runs-on: ubuntu-latest

.github/workflows/tests.yaml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ develop ]
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
 jobs:
 
   unit-tests:

.github/workflows/trigger-skeletons.yml

@@ -12,6 +12,9 @@ on:
         required: true
         default: true
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
 jobs:
   build:
     runs-on: ubuntu-latest