Merge pull request #11038 from sashashura/patch-3

GitHub Workflows security hardening

.github/workflows/build-checks.yml

@@ -6,8 +6,15 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read #  to fetch code (actions/checkout)
+
 jobs:
   build-checks:
+    permissions:
+      contents: read #  to fetch code (actions/checkout)
+      checks: write #  to create new checks (coverallsapp/github-action)
+
     strategy:
       matrix:
         include:

.github/workflows/build.yml

@@ -6,6 +6,9 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read #  to fetch code (actions/checkout)
+
 jobs:
   build:
     strategy:

.github/workflows/changelog.yml

@@ -10,6 +10,7 @@ on:
     paths:
       - "CHANGELOG.md"
 
+permissions: {}
 jobs:
   trigger-changelog-update:
     name: Trigger Changelog update on manual repository

.github/workflows/pre-commit.yml

@@ -6,6 +6,9 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read #  to fetch code (actions/checkout)
+
 jobs:
   pre-commit:
     name: Detecting code style issues