chore: add job-level permissions to workflows (#1177)

Author: ffflorian

.github/workflows/build_test_publish.yml

@@ -1,17 +1,17 @@
 name: Build
 
+permissions: {}
+
 on:
   push:
     branches: [main]
   pull_request:
     branches: [main]
-
-permissions:
-  id-token: write
-  contents: write
-
 jobs:
   build_test_publish:
+    permissions:
+      id-token: write
+      contents: write
     name: Build, test and publish
     runs-on: ubuntu-latest
     steps:

.github/workflows/codeql.yml

@@ -11,6 +11,8 @@
 #
 name: 'CodeQL Advanced'
 
+permissions: {}
+
 on:
   push:
     branches: ['main']

.github/workflows/force-release.yml

@@ -1,13 +1,14 @@
 name: Force Release
 
-permissions:
-  contents: write
+permissions: {}
 
 on:
   workflow_dispatch:
 
 jobs:
   force-release:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository

.github/workflows/git_mirror.yml

@@ -1,14 +1,15 @@
 name: Mirror to Codeberg and GitLab
 
-permissions:
-  contents: read
+permissions: {}
 
 on:
   push:
     branches: [main]
 
 jobs:
   mirror:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - uses: ffflorian/actions/git-mirror@baf8fb2e65ebe6564870f56315a09bc01ab7e0f7

.github/workflows/yarn_update.yml

@@ -1,8 +1,6 @@
 name: Check for yarn updates
 
-permissions:
-  contents: write
-  pull-requests: write
+permissions: {}
 
 on:
   schedule:
@@ -16,6 +14,9 @@ on:
 
 jobs:
   yarn-update-check:
+    permissions:
+      contents: write
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - name: Update yarn