ci: Restrict permissions for GITHUB_TOKEN

.github/workflows/chart.yaml

@@ -18,9 +18,7 @@ env:
   CHART_LOCATION: weaveworks/charts
 
 permissions:
-  contents: write
-  id-token: write
-  packages: write
+  contents: read # for actions/checkout to fetch code
 
 jobs:
   helm-new-version:
@@ -80,6 +78,8 @@ jobs:
     runs-on: ubuntu-latest
     needs: helm-new-version
     if: (github.event_name == 'push' && needs.helm-new-version.outputs.old-version != needs.helm-new-version.outputs.new-version) || github.event_name == 'workflow_dispatch'
+    permissions:
+      packages: write # needed for ghcr access
     steps:
       - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
       - name: Find new version

.github/workflows/docs.yaml

@@ -13,8 +13,10 @@ on:
       - 'website/**'
   workflow_dispatch:
 
-jobs:
+permissions:
+  contents: read # for actions/checkout to fetch code
 
+jobs:
   staging-release:
     permissions:
       statuses: write

.github/workflows/pr.yaml

@@ -7,6 +7,9 @@ on:
       - main
   workflow_dispatch:
 
+permissions:
+  contents: read # for actions/checkout to fetch code
+
 env:
   CI_CONTAINER_REGISTRY: europe-west1-docker.pkg.dev
   CI_CONTAINER_REPOSITORY: europe-west1-docker.pkg.dev/weave-gitops-clusters/weave-gitops

.github/workflows/prepare-release.yaml

@@ -7,6 +7,9 @@ on:
         description: "Version (e.g. 'v1.2.3-rc.4')"
         required: true
 
+permissions:
+  contents: read # for actions/checkout to fetch code
+  pull-requests: read # for mikepenz/release-changelog-builder-action to create changelog
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: weaveworks/wego-app

.github/workflows/release.yaml

@@ -5,6 +5,9 @@ on:
     types:
       - submitted
 
+permissions:
+  contents: read # for actions/checkout to fetch code
+
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: weaveworks/wego-app
@@ -15,6 +18,8 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.release-version.outputs.version }}
+    permissions:
+      contents: write # for action to git push a tag
     steps:
       - name: Checkout
         uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
@@ -37,6 +42,8 @@ jobs:
   publish_npm_package:
     needs: tag-release
     runs-on: ubuntu-latest
+    permissions:
+      packages: write # needed for GitHub Packages registry access
     steps:
       - name: Checkout
         uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
@@ -51,11 +58,11 @@ jobs:
       - run: make ui-lib && cd dist && npm publish
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
   build-and-push-image:
     needs: tag-release
     runs-on: ubuntu-latest
     permissions:
-      contents: read
       packages: write
     steps:
       - name: Checkout