chore(ci): tighten workflow token permissions

Author: scop

.github/workflows/docs.yml

@@ -9,10 +9,15 @@ on:
     types:
     - released
 
+permissions:
+  contents: read
+
 jobs:
   generate-and-deploy:
     name: Generate and deploy
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout head
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

.github/workflows/examples.yml

@@ -13,6 +13,9 @@ concurrency:
   group: ${{ github.repository }}-${{ github.workflow }}
   cancel-in-progress: false
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test

.github/workflows/lint.yml

@@ -6,6 +6,8 @@ on:
       - 'go.mod'
       - 'go.sum'
       - '.github/workflows/lint.yml'
+permissions:
+  contents: read
 jobs:
   golangci-lint:
     name: golangci-lint

.github/workflows/publish.yml

@@ -3,6 +3,8 @@ on:
   push:
     tags:
       - 'v*.*.*'
+permissions:
+  contents: read
 jobs:
   publish_release:
     name: Release

.github/workflows/test.yml

@@ -5,6 +5,8 @@ on:
       - '**.go'
       - 'go.mod'
       - 'go.sum'
+permissions:
+  contents: read
 jobs:
   unit-tests:
     name: Run unit-tests