ci: Adjust GitHub workflow permissions

Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>

.github/workflows/build.yaml

@@ -10,10 +10,10 @@ on:
       - main
 
 permissions:
-  contents: read # for actions/checkout to fetch code
+  contents: read
 
 jobs:
-  container:
+  build-flagger:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout

.github/workflows/e2e.yaml

@@ -10,10 +10,10 @@ on:
       - main
 
 permissions:
-  contents: read # for actions/checkout to fetch code
+  contents: read
 
 jobs:
-  kind:
+  e2e-test:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false

.github/workflows/helm.yaml

@@ -4,11 +4,13 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write # needed to push chart
+  contents: read
 
 jobs:
-  build-push:
+  release-charts:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v2
       - name: Publish Helm charts

.github/workflows/push-ld.yml

@@ -6,12 +6,13 @@ env:
   IMAGE: "ghcr.io/fluxcd/flagger-loadtester"
 
 permissions:
-  contents: write # needed to write releases
-  packages: write # needed for ghcr access
+  contents: read
 
 jobs:
-  build-push:
+  release-load-tester:
     runs-on: ubuntu-latest
+    permissions:
+      packages: write
     steps:
       - uses: actions/checkout@v2
       - name: Prepare

.github/workflows/release.yml

@@ -5,16 +5,18 @@ on:
       - 'v*'
 
 permissions:
-  contents: write # needed to write releases
-  id-token: write # needed for keyless signing
-  packages: write # needed for ghcr access
+  contents: read
 
 env:
   IMAGE: "ghcr.io/fluxcd/${{ github.event.repository.name }}"
 
 jobs:
-  build-push:
+  release-flagger:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # needed to write releases
+      id-token: write # needed for keyless signing
+      packages: write # needed for ghcr access
     steps:
       - uses: actions/checkout@v2
       - uses: sigstore/cosign-installer@main

.github/workflows/scan.yml

@@ -9,13 +9,13 @@ on:
     - cron: '18 10 * * 3'
 
 permissions:
-  contents: read # for actions/checkout to fetch code
-  security-events: write # for codeQL to write security events
+  contents: read
 
 jobs:
-  fossa:
-    name: FOSSA
+  scan-fossa:
     runs-on: ubuntu-latest
+    permissions:
+      security-events: write
     steps:
       - uses: actions/checkout@v2
       - name: Run FOSSA scan and upload build data
@@ -24,10 +24,10 @@ jobs:
           # FOSSA Push-Only API Token
           fossa-api-key: 5ee8bf422db1471e0bcf2bcb289185de
           github-token: ${{ github.token }}
-
-  codeql:
-    name: CodeQL
+  scan-codeql:
     runs-on: ubuntu-latest
+    permissions:
+      security-events: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@v2