Merge pull request #1430 from kubescape/token

add top level permissions: read-all for openssf

.github/workflows/00-pr-scanner.yaml

@@ -1,4 +1,5 @@
 name: 00-pr_scanner
+permissions: read-all
 on:
   pull_request:
     types: [opened, reopened, synchronize, ready_for_review]
@@ -12,7 +13,7 @@ on:
       - 'docs/*'
       - 'build/*'
       - '.github/*'
-      
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -26,7 +27,7 @@ jobs:
       RELEASE: ""
       CLIENT: test
     secrets: inherit
- 
+
   binary-build:
     uses: ./.github/workflows/b-binary-build-and-e2e-tests.yaml
     with:

.github/workflows/02-release.yaml

@@ -1,4 +1,5 @@
 name: 02-create_release
+permissions: read-all
 on:
   push:
     tags:

.github/workflows/03-post-release.yaml

@@ -1,4 +1,5 @@
 name: 03-post_release
+permissions: read-all
 on:
   release:
     types: [published]

.github/workflows/04-publish-krew-plugin.yaml

@@ -1,4 +1,5 @@
 name: 04-publish_krew_plugin
+permissions: read-all
 on:
   push:
     tags:

.github/workflows/a-pr-scanner.yaml

@@ -1,4 +1,5 @@
 name: a-pr-scanner
+permissions: read-all
 on:
   workflow_call:
     inputs:
@@ -68,7 +69,7 @@ jobs:
 
       - name: Convert coverage count to lcov format
         uses: jandelgado/gcov2lcov-action@v1
-        
+
       - name: Submit coverage tests to Coveralls
         continue-on-error: true
         uses: coverallsapp/github-action@v1

.github/workflows/b-binary-build-and-e2e-tests.yaml

@@ -1,5 +1,5 @@
 name: b-binary-build-and-e2e-tests
-
+permissions: read-all
 on:
   workflow_dispatch:
     inputs:

.github/workflows/build-image.yaml

@@ -1,5 +1,5 @@
 name: build-image
-
+permissions: read-all
 on:
     workflow_dispatch:
       inputs:

.github/workflows/c-create-release.yaml

@@ -1,4 +1,5 @@
 name: c-create_release
+permissions: read-all
 on:
   workflow_call:
     inputs:

.github/workflows/comments.yaml

@@ -1,5 +1,5 @@
 name: pr-agent
-
+permissions: read-all
 on:
   issue_comment:
 
@@ -19,5 +19,3 @@ jobs:
         env:
           OPENAI_KEY: ${{ secrets.OPENAI_KEY }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-   
-

.github/workflows/d-publish-image.yaml

@@ -1,4 +1,5 @@
 name: d-publish-image
+permissions: read-all
 on:
   workflow_call:
     inputs:
@@ -38,7 +39,7 @@ jobs:
           QUAYIO_REGISTRY_PASSWORD: ${{ secrets.QUAYIO_REGISTRY_PASSWORD }}
         run: |
           echo "is-secret-set=${{ env.QUAYIO_REGISTRY_USERNAME != '' && env.QUAYIO_REGISTRY_PASSWORD != '' }}" >> $GITHUB_OUTPUT
-          
+
   build-cli-image:
     needs: [check-secret]
     if: needs.check-secret.outputs.is-secret-set == 'true'

.github/workflows/z-close-typos-issues.yaml

@@ -1,3 +1,4 @@
+permissions: read-all
 on:
   issues:
     types: [opened, labeled]