Downgrade the GITHUB_TOKEN privileges in GitHub Workflows CI/CD

PR #6969

.github/workflows/ci.yml

@@ -23,9 +23,13 @@ env:
   MYPY_FORCE_COLOR: 1
   PY_COLORS: 1
 
+permissions: {}
 jobs:
 
   lint:
+    permissions:
+      contents: read # to fetch code (actions/checkout)
+
     name: Linter
     runs-on: ubuntu-latest
     timeout-minutes: 5
@@ -88,6 +92,9 @@ jobs:
         LC_ALL=C sort --check --ignore-case CONTRIBUTORS.txt
 
   gen_llhttp:
+    permissions:
+      contents: read # to fetch code (actions/checkout)
+
     name: Generate llhttp sources
     runs-on: ubuntu-latest
     timeout-minutes: 5
@@ -119,6 +126,9 @@ jobs:
         if-no-files-found: error
 
   test:
+    permissions:
+      contents: read # to fetch code (actions/checkout)
+
     name: Test
     needs: gen_llhttp
     strategy:
@@ -256,6 +266,9 @@ jobs:
             echo "Predeploy step"
 
   build-tarball:
+    permissions:
+      contents: read # to fetch code (actions/checkout)
+
     name: Tarball
     runs-on: ubuntu-latest
     needs: pre-deploy
@@ -290,6 +303,9 @@ jobs:
         path: dist
 
   build-wheels:
+    permissions:
+      contents: read # to fetch code (actions/checkout)
+
     name: Build wheels on ${{ matrix.os }} ${{ matrix.qemu }}
     runs-on: ${{ matrix.os }}-latest
     needs: pre-deploy
@@ -352,6 +368,9 @@ jobs:
         path: ./wheelhouse/*.whl
 
   deploy:
+    permissions:
+      contents: write # to make release
+
     name: Deploy
     environment: release
     needs: [build-tarball, build-wheels]

.github/workflows/post-dependabot.yml

@@ -10,8 +10,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
+permissions: {}
 jobs:
   post-update:
+    permissions:
+      pull-requests: read # for gh pr checkout
+      contents: write # to push code in repo (stefanzweifel/git-auto-commit-action)
+
     if: ${{ github.actor == 'dependabot[bot]' }}
     runs-on: ubuntu-latest
     steps:

.github/workflows/update-pre-commit.yml

@@ -2,6 +2,7 @@ name: Pre-commit auto-update
 on:
   schedule:
   - cron: '0 0 * * *'
+permissions: {}
 jobs:
   auto-update:
     if: github.repository_owner == 'aiohttp'