Explicit permissions for github actions

To improve OSSF Scorecard score on Scorecard repo

.github/workflows/codeql-analysis.yml

@@ -35,11 +35,13 @@ on:
 
 permissions:
   contents: read
-  statuses: write
-  security-events: write
 
 jobs:
   analyze:
+    permissions:
+      actions: read  # for github/codeql-action/init to get workflow details
+      contents: read  # for actions/checkout to fetch code
+      security-events: write  # for github/codeql-action/autobuild to send a status report
     name: Analyze
     runs-on: ubuntu-latest
 

.github/workflows/docker.yml

@@ -12,6 +12,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+permissions:
+  contents: read
+
 name: docker-build
 on: 
  push:

.github/workflows/goreleaser.yaml

@@ -19,11 +19,14 @@ on:
     tags:
       - "*" # triggers only if push new tag version, like `0.8.4` or else
 
+permissions:
+  contents: read
+
 jobs:
   goreleaser:
-    runs-on: ubuntu-latest
     permissions:
-     contents: write
+      contents: write  # for goreleaser/goreleaser-action to create a GitHub release
+    runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@bdb12b622a910dfdc99a31fdfe6f45a16bc287a4 # v1

.github/workflows/main.yml

@@ -13,6 +13,10 @@
 # limitations under the License.
 
 name: build
+
+permissions:
+  contents: read
+
 on:
   push:
     branches: