Merge pull request #3445 from kolyshkin/gha-ro

ci/gha: limit jobs permissions

.github/workflows/test.yml

@@ -10,6 +10,8 @@ on:
       - main
       - release-*
   pull_request:
+permissions:
+  contents: read
 
 env:
   # Don't ignore C warnings. Note that the output of "go env CGO_CFLAGS" by default is "-g -O2", so we keep them.

.github/workflows/validate.yml

@@ -9,10 +9,15 @@ on:
   pull_request:
 env:
   GO_VERSION: 1.18.x
+permissions:
+  contents: read
 
 jobs:
 
   lint:
+    permissions:
+      contents: read
+      pull-requests: read
     runs-on: ubuntu-20.04
     steps:
       - uses: actions/checkout@v3
@@ -127,6 +132,9 @@ jobs:
 
 
   commit:
+    permissions:
+      contents: read
+      pull-requests: read
     runs-on: ubuntu-20.04
     # Only check commits on pull requests.
     if: github.event_name == 'pull_request'