fix: Apply changes recommended by the OpenSSF (#1861)

.github/workflows/build-image-beta.yml

@@ -12,6 +12,11 @@ on:
    workflow_call:
    workflow_dispatch:
 
+permissions:
+  contents: read
+  packages: write
+  id-token: write
+
 jobs:
   build-image-beta:
     name: Build Beta Images

.github/workflows/build-image-latest-main.yml

@@ -11,6 +11,11 @@ on:
   workflow_call:
   workflow_dispatch:
 
+permissions:
+  contents: write
+  packages: write
+  id-token: write
+
 jobs:
   build-image-latest:
     name: Build Latest Images

.github/workflows/build-image-stable.yml

@@ -13,6 +13,11 @@ on:
   workflow_call:
   workflow_dispatch:
 
+permissions:
+  contents: write
+  packages: write
+  id-token: write
+
 jobs:
   build-image-stable:
     name: Build Stable Images

.github/workflows/build-images.yml

@@ -3,9 +3,9 @@ on:
     workflow_dispatch:
 
 permissions:
-    contents: read
-    packages: write
-    id-token: write
+  contents: write
+  packages: write
+  id-token: write
 
 jobs:
     build-image-stable:

.github/workflows/clean.yml

@@ -4,6 +4,8 @@ on:
     - cron: "15 0 * * 0" # 0015 UTC on Sundays
   workflow_dispatch:
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
 

.github/workflows/generate-release.yml

@@ -16,13 +16,14 @@ on:
         options:
           - '["stable"]'
 
-permissions:
-  contents: write
+permissions: {}
 
 name: Generate Release
 jobs:
   generate-release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:

.github/workflows/moderator.yml

@@ -7,6 +7,8 @@ on:
   pull_request_review_comment:
     types: [created]
 
+permissions: {}
+
 jobs:
   spam-detection:
     runs-on: ubuntu-slim

.github/workflows/reusable-build.yml

@@ -26,10 +26,16 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build_container:
     name: image
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
     continue-on-error: false
     strategy:
       fail-fast: false

.github/workflows/validate-just.yml

@@ -12,6 +12,8 @@ on:
       - "Justfile"
       - "just/*"
 
+permissions: {}
+
 jobs:
   validate:
     runs-on: ubuntu-latest

.github/workflows/validate-renovate.yml

@@ -12,6 +12,8 @@ on:
       - ".github/renovate.json5"
       - ".github/workflows/renovate.yml"
 
+permissions: {}
+
 jobs:
   validate:
     runs-on: ubuntu-latest