chore: Set permissions for GitHub actions

.github/workflows/boost_version.yml

@@ -47,6 +47,9 @@ on:
     branches-ignore:
       - 'gh-pages'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Ubuntu Boost

.github/workflows/check-files.yml

@@ -12,6 +12,9 @@ name: Check files
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   Signature_check:
     runs-on: ubuntu-latest

.github/workflows/check-queries.yml

@@ -40,6 +40,9 @@ on:
     branches-ignore:
       - 'gh-pages'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Check queries

.github/workflows/clang.yml

@@ -37,6 +37,9 @@ on:
     branches-ignore:
       - 'gh-pages'
 
+permissions:
+  contents: read
+
 jobs:
   Test_clang:
     name: Ubuntu clang

.github/workflows/doc-check.yml

@@ -37,6 +37,9 @@ on:
     branches-ignore:
       - 'gh-pages'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: documentation

.github/workflows/locale-and-website.yml

@@ -7,8 +7,13 @@ on:
       - main
       - develop
 
+permissions:
+  contents: read
+
 jobs:
   release:
+    permissions:
+      contents: write  # for Git to git push
     name: Update Locale and Website
     runs-on: ubuntu-latest
     if: ${{ github.repository_owner == 'pgRouting' }}

.github/workflows/macos.yml

@@ -6,6 +6,9 @@ name: Build for macOS
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: macos

.github/workflows/release.yml

@@ -6,8 +6,13 @@ on:
       - 'v*.*.*'
 
 
+permissions:
+  contents: read
+
 jobs:
   release:
+    permissions:
+      contents: write  # for Git to git push
     name: Release
     runs-on: ubuntu-latest
 

.github/workflows/ubuntu.yml

@@ -7,6 +7,9 @@ name: Build for Ubuntu
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Ubuntu psql

.github/workflows/update.yml

@@ -7,6 +7,9 @@ name: Update
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build