ci: add minimum GitHub token permissions for workflows

.github/workflows/async-history.yml

@@ -8,6 +8,9 @@ env:
     -B -V --no-transfer-progress
     -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.httpconnectionManager.ttlSeconds=120
 
+permissions:
+  contents: read
+
 jobs:
   test_async:
     name: Async History ${{ matrix.engineModule }}

.github/workflows/db2.yml

@@ -11,6 +11,9 @@ env:
     -B -V --no-transfer-progress
     -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.httpconnectionManager.ttlSeconds=120
 
+permissions:
+  contents: read
+
 jobs:
   test_db2:
     name: DB2 ${{ matrix.db2 }}

.github/workflows/docker-release-with-latest.yml

@@ -2,6 +2,9 @@ name: Release Docker Images With Latest
 
 on: workflow_dispatch
 
+permissions:
+  contents: read
+
 jobs:
   release_docker_images_with_latest:
     runs-on: ubuntu-latest

.github/workflows/docker-release.yml

@@ -2,6 +2,9 @@ name: Release Docker Images
 
 on: workflow_dispatch
 
+permissions:
+  contents: read
+
 jobs:
   release_docker_images:
     runs-on: ubuntu-latest

.github/workflows/flowable5.yml

@@ -2,6 +2,9 @@ name: Flowable 5 Build
 
 on: [push]
 
+permissions:
+  contents: read
+
 jobs:
   test_jdk:
     name: Flowable 5 Tests

.github/workflows/helm-release.yml

@@ -5,8 +5,13 @@ on:
     branches:
       - flowable-helm
 
+permissions:
+  contents: read
+
 jobs:
   release:
+    permissions:
+      contents: write  # for helm/chart-releaser-action to push chart release and create a release
     runs-on: ubuntu-latest
     steps:
       - name: Checkout

.github/workflows/java-ea.yml

@@ -11,6 +11,9 @@ env:
     -B -V --no-transfer-progress
     -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.httpconnectionManager.ttlSeconds=120
 
+permissions:
+  contents: read
+
 jobs:
   test_jdkea:
     name: Linux (OpenJDK EA)

.github/workflows/main.yml

@@ -7,6 +7,9 @@ env:
     -B -V --no-transfer-progress
     -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.httpconnectionManager.ttlSeconds=120
 
+permissions:
+  contents: read
+
 jobs:
   test_jdk:
     name: Linux (JDK ${{ matrix.java }})

.github/workflows/mariadb.yml

@@ -13,6 +13,9 @@ env:
     -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.httpconnectionManager.ttlSeconds=120
 
 # We explicitly don't use a container for running the job since there is some connectivity issues to MariaDB if that is done
+permissions:
+  contents: read
+
 jobs:
   test_mariadb:
     name: MariaDB ${{ matrix.mariadb }}

.github/workflows/mysql.yml

@@ -13,6 +13,9 @@ env:
     -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.httpconnectionManager.ttlSeconds=120
 
 # We explicitly don't use a container for running the job since there is some connectivity issues to MySQL if that is done
+permissions:
+  contents: read
+
 jobs:
   test_mysql:
     name: MySQL ${{ matrix.mysql }}

.github/workflows/oracle.yml

@@ -11,6 +11,9 @@ env:
     -B -V --no-transfer-progress
     -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.httpconnectionManager.ttlSeconds=120
 
+permissions:
+  contents: read
+
 jobs:
   test_oracle:
     name: Oracle ${{ matrix.oracle }}

.github/workflows/postgres.yml

@@ -12,6 +12,9 @@ env:
     -B -V --no-transfer-progress
     -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.httpconnectionManager.ttlSeconds=120
 
+permissions:
+  contents: read
+
 jobs:
   test_postgres:
     name: Postgres ${{ matrix.postgres }}

.github/workflows/sql-server.yml

@@ -12,6 +12,9 @@ env:
     -B -V --no-transfer-progress
     -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.httpconnectionManager.ttlSeconds=120
 
+permissions:
+  contents: read
+
 jobs:
   test_mssql:
     name: SQL Server ${{ matrix.mssql }}

.github/workflows/windows.yml

@@ -7,6 +7,9 @@ env:
     -B -V --no-transfer-progress
     -D http.keepAlive=false -D maven.wagon.http.pool=false -D maven.wagon.httpconnectionManager.ttlSeconds=120
 
+permissions:
+  contents: read
+
 jobs:
   windows:
     name: 'Windows'