Add explicit least-privilege permissions to CI workflows

.github/workflows/build_all_apps.yml

@@ -21,6 +21,9 @@ name: Apps
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   targets:
     name: Build all apps

.github/workflows/build_blinky.yml

@@ -21,6 +21,9 @@ name: Blinky
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   blinky:
     name: Build blinky

.github/workflows/build_bootloader.yml

@@ -21,6 +21,9 @@ name: Bootloader
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   bootloader:
     name: Build bootloader

.github/workflows/build_bootloader_main.yml

@@ -26,6 +26,9 @@ on:
   schedule:
     - cron: 42 0 * * *
 
+permissions:
+  contents: read
+
 jobs:
   bootloader:
     name: Build bootloader (main)

.github/workflows/build_cc_target.yml

@@ -21,6 +21,9 @@ name: GCC target
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   targets:
     name: Build GCC test target

.github/workflows/build_targets.yml

@@ -21,6 +21,9 @@ name: Targets
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   targets:
     name: Build all test targets

.github/workflows/check_compliance.yml

@@ -23,6 +23,11 @@ on:
   pull_request:
     types: [opened, synchronize, reopened, labeled, unlabeled]
 
+permissions:
+  contents: read
+  issues: read
+  pull-requests: read
+
 
 jobs:
   style_check:

.github/workflows/newt_test_all.yml

@@ -21,6 +21,9 @@ name: Unit tests
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   newt_test:
     name: Run newt test all

.github/workflows/update_hw_ci_badges.yml

@@ -23,6 +23,10 @@ on:
   schedule:
     - cron: '0 5 * * *'
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   update-badges:
     runs-on: ubuntu-latest