ci: reduce permissions for GITHUB_TOKEN.

.github/workflows/ci.yml

@@ -1,5 +1,9 @@
 name: Unit Tests
 
+# See, scorecard.dev (Token Permission)
+# https://github.com/ossf/scorecard/blob/a16e0f9eb245274f08512e33dc7afa78d21c460c/docs/checks.md#token-permissions
+permissions: read-all
+
 concurrency:
   group: ${{ github.workflow }}#${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'main' }}

.github/workflows/clang_format.yml

@@ -1,5 +1,7 @@
 name: ClangFormat
 
+permissions: read-all
+
 concurrency:
   group: ${{ github.workflow }}#${{ github.ref }}
   cancel-in-progress: true

.github/workflows/coverage.yml

@@ -1,5 +1,7 @@
 name: Coverage
 
+permissions: read-all
+
 concurrency:
   group: ${{ github.workflow }}#${{ github.ref }}
   cancel-in-progress: true

.github/workflows/gh-pages.yml

@@ -1,5 +1,10 @@
 name: Documentation
 
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
 on:
   push:
     branches:
@@ -9,11 +14,6 @@ on:
       - v2.x
       - main
 
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-
 # Allow only one concurrent deployment
 concurrency:
   group: ${{ github.workflow }}#${{ github.ref }}

.github/workflows/integration_trigger.yml

@@ -1,5 +1,7 @@
 name: Integration Test Trigger
 
+permissions: read-all
+
 on:
   push:
     branches:

.github/workflows/version_file.yml

@@ -1,5 +1,7 @@
 name: HighFive Check Version File
 
+permissions: read-all
+
 on:
   workflow_dispatch:
   push: