GAUD-10637 - Add workflow permissions

.github/workflows/ci.yml

@@ -1,5 +1,9 @@
 name: CI
 on: pull_request
+
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test

.github/workflows/release.yml

@@ -5,6 +5,10 @@ on:
       - main
       - '[0-9]+.x'
       - '[0-9]+.[0-9]+.x'
+
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Release

src/generators/default-content/templates/static/.github/workflows/update-package-lock.yml

@@ -3,6 +3,10 @@ on:
   schedule:
     - cron: "30 12 * * 1-5" # Mon-Fri 8:30AM EDT. 7:30AM EST.
   workflow_dispatch: # manual trigger
+
+permissions:
+  pull-requests: write
+
 jobs:
   update:
     name: Update

src/generators/release/templates/static/.github/workflows/release.yml

@@ -5,6 +5,10 @@ on:
       - main
       - '[0-9]+.x'
       - '[0-9]+.[0-9]+.x'
+
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Release

src/generators/static-site/templates/.github/workflows/publish.yml

@@ -5,6 +5,10 @@ on:
       - main
       - '[0-9]+.x'
       - '[0-9]+.[0-9]+.x'
+
+permissions:
+  contents: read
+
 jobs:
   publish:
     name: Publish

src/generators/test-unit-axe/templates/static/.github/workflows/ci-test-reporting.yml

@@ -1,5 +1,9 @@
 name: CI
 on: pull_request
+
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test

src/generators/test-unit-axe/templates/static/.github/workflows/ci.yml

@@ -1,5 +1,9 @@
 name: CI
 on: pull_request
+
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test

src/generators/test-vdiff/templates/static/.github/workflows/vdiff-test-reporting.yml

@@ -1,5 +1,12 @@
 name: vdiff
 on: pull_request
+
+permissions:
+  actions: read
+  contents: write
+  pull-requests: write
+  statuses: write
+
 jobs:
   vdiff:
     timeout-minutes: 5

src/generators/test-vdiff/templates/static/.github/workflows/vdiff.yml

@@ -1,5 +1,12 @@
 name: vdiff
 on: pull_request
+
+permissions:
+  actions: read
+  contents: write
+  pull-requests: write
+  statuses: write
+
 jobs:
   vdiff:
     timeout-minutes: 5