ci: Specify permissions for CI (#4338)

Co-authored-by: Link <link20050703@gmail.com>

.github/workflows/benchmark.yml

@@ -1,5 +1,8 @@
 name: Benchmark
-
+permissions:
+  contents: write
+  deployments: write
+  actions: write
 on:
   workflow_call:
     inputs:

.github/workflows/commentBenchResult.yml

@@ -1,5 +1,8 @@
 name: Comment Benchmark Result
-
+permissions:
+  contents: read
+  actions: read
+  pull-requests: write
 on:
   workflow_run:
     workflows: [Benchmark with retry]

.github/workflows/docker-app-rest-passthrough.yml

@@ -1,5 +1,6 @@
 name: Docker App - Rest Passthrough
-
+permissions:
+  contents: read
 on:
   push:
     branches:
@@ -50,6 +51,9 @@ jobs:
     name: Build docker image
     runs-on: ubuntu-latest
     needs: app-version
+    permissions:
+      contents: read
+      actions: write
     steps:
       - uses: actions/checkout@v4
       - name: Cache Docker layers
@@ -90,6 +94,10 @@ jobs:
     name: Image scan
     runs-on: ubuntu-latest
     needs: build
+    permissions: 
+      contents: read
+      security-events: write
+      actions: read
     steps:
       - uses: actions/checkout@v4
       - name: Set up Docker Buildx

.github/workflows/e2e-test.yml

@@ -1,5 +1,6 @@
 name: E2E Test
-
+permissions:
+  contents: read
 on:
   workflow_call:
     inputs:

.github/workflows/integration-test.yml

@@ -1,5 +1,6 @@
 name: Package Test
-
+permissions:
+  contents: read
 on:
   workflow_call:
     inputs:

.github/workflows/labeler.yml

@@ -1,5 +1,7 @@
 name: Labeler
-
+permissions:
+  issues: write
+  pull-requests: write
 on:
   pull_request_target:
     types: ['edited', 'opened', 'reopened', 'synchronize']

.github/workflows/lib-check-e2e.yml

@@ -1,5 +1,6 @@
 name: Library Checks (E2E)
-
+permissions:
+  contents: read
 on:
   pull_request:
   push:

.github/workflows/lib-check.yml

@@ -1,5 +1,6 @@
 name: Library Checks
-
+permissions:
+  contents: read
 on:
   pull_request:
   push:

.github/workflows/other-runtime-unit-test.yml

@@ -1,5 +1,6 @@
 name: Other Runtime Package Test
-
+permissions:
+  contents: read
 on:
   workflow_call:
     inputs:

.github/workflows/release.yml

@@ -1,5 +1,8 @@
 name: Release
-
+permissions:
+  contents: read
+  packages: write
+  id-token: write
 on:
   push:
     branches:
@@ -14,10 +17,6 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-      id-token: write
     strategy:
       fail-fast: false
       matrix:

.github/workflows/retryBenchmark.yml

@@ -1,5 +1,6 @@
 name: Benchmark with retry
-
+permissions:
+  contents: read
 on:
   pull_request:
     paths-ignore:

.github/workflows/site.yml

@@ -1,5 +1,6 @@
 name: Deploy Docs Site
-
+permissions:
+  contents: read
 on:
   push:
     branches: ['main']
@@ -12,15 +13,13 @@ on:
   pull_request:
   workflow_dispatch:
 
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-
 jobs:
   build:
     name: Build Docusaurus
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: write
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -81,6 +80,9 @@ jobs:
     needs: build
     if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
     concurrency: deploy-site
+    permissions:
+      pages: write
+      id-token: write
     steps:
       - name: Deploy to GitHub Pages
         id: deployment

.github/workflows/stale.yml

@@ -4,7 +4,9 @@
 # For more information, see:
 # https://github.com/actions/stale
 name: Mark stale issues and pull requests
-
+permissions:
+  issues: write
+  pull-requests: write
 on:
   schedule:
     - cron: '0 0 * * 1'
@@ -12,10 +14,6 @@ on:
 jobs:
   stale:
     runs-on: ubuntu-latest
-    permissions:
-      issues: write
-      pull-requests: write
-
     steps:
       - uses: actions/stale@v9
         with:

.github/workflows/unit-test.yml

@@ -1,5 +1,6 @@
 name: Package Test
-
+permissions:
+  contents: read
 on:
   workflow_call:
     inputs: