[TASK] Harden Github Actions workflows (#649)

Resolves: #614

.github/workflows/ci.yml

@@ -9,6 +9,8 @@ on:
   pull_request:
   schedule:
     - cron: '15 3 * * 1'
+permissions:
+  contents: read
 jobs:
   php-lint:
     name: "PHP linter"

.github/workflows/codecoverage.yml

@@ -6,9 +6,13 @@ on:
     branches:
       - main
   pull_request:
+permissions:
+  contents: read
 jobs:
   code-coverage:
     name: "Calculate code coverage"
+    permissions:
+      actions: write
     runs-on: ubuntu-22.04
     env:
       DB_DATABASE: typo3

.github/workflows/predefined.yml

@@ -8,6 +8,8 @@
 name: CI with predefined GitHub actions
 on:
   workflow_dispatch:
+permissions:
+  contents: read
 jobs:
   php-lint:
     name: "PHP linter"

.github/workflows/publish.yml

@@ -4,9 +4,12 @@ on:
   push:
     tags:
       - 'v[0-9]+.[0-9]+.[0-9]+'
-
+permissions:
+  contents: read
 jobs:
   publish:
+    permissions:
+      actions: write
     runs-on: ubuntu-22.04
     steps:
       - name: "Checkout"

CHANGELOG.md

@@ -6,6 +6,7 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 ## x.y.z
 
 ### Added
+- Harden the GitHub Actions workflows (#649)
 - Add support for TYPO3 12 (#652)
 - Add `.gitignore` entry for JetBrains Fleet editor (#642)