Merge pull request #3084 from sashashura/patch-1

GitHub Workflows security hardening

.github/workflows/github-pages.yml

@@ -4,8 +4,12 @@ on:
     tags:
       - '*'
 
+permissions: {}
 jobs:
   github-pages:
+    permissions:
+      contents: write # to push pages branch (peaceiris/actions-gh-pages)
+
     runs-on: ubuntu-latest
     steps:
       - name: Checkout

.github/workflows/main.yml

@@ -1,5 +1,7 @@
 name: main
 on: [ push, pull_request, merge_group ]
+permissions:
+  contents: read # to fetch code (actions/checkout)
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -241,6 +243,8 @@ jobs:
           ~/.composer/vendor/bin/ocular code-coverage:upload --format=php-clover coverage-clover.xml
 
   release:
+    permissions:
+      contents: write # to create a release (actions/create-release)
     runs-on: ubuntu-latest
     if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
     steps: