OpenSSF Scorecard - Set token-permissions to content-read (#4125)

Author: Kielek

.github/workflows/build-container.yml

@@ -3,6 +3,9 @@ name: Build on Containers
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 env:
   NUGET_PACKAGES: ${{ github.workspace }}/packages
   DOTNET_CLI_TELEMETRY_OPTOUT: 1

.github/workflows/build-nuget-packages.yml

@@ -8,6 +8,8 @@ on:
         description: "The NuGet version suffix to build the packages"
         value: ${{ jobs.build-nuget-packages.outputs.nuget-version-suffix }}
 
+permissions:
+  contents: read
 
 env:
   NUGET_PACKAGES: ${{ github.workspace }}/packages

.github/workflows/build-ubuntu1604-native-container.yml

@@ -3,6 +3,9 @@ name: Build on Ubuntu 16.04 Native Container
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 env:
   NUGET_PACKAGES: ${{ github.workspace }}/packages
   DOTNET_CLI_TELEMETRY_OPTOUT: 1

.github/workflows/build.yml

@@ -7,6 +7,9 @@ env:
   NUGET_PACKAGES: ${{ github.workspace }}/packages
   DOTNET_CLI_TELEMETRY_OPTOUT: 1
 
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy:

.github/workflows/check-sdk-versions.yml

@@ -7,6 +7,9 @@ on:
   merge_group:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   check-sdk-versions:
     runs-on: windows-latest

.github/workflows/ci.yml

@@ -11,6 +11,9 @@ env:
   NUGET_PACKAGES: ${{ github.workspace }}/packages
   DOTNET_CLI_TELEMETRY_OPTOUT: 1
 
+permissions:
+  contents: read
+
 jobs:
   build-container:
     uses: ./.github/workflows/build-container.yml

.github/workflows/demo.yml

@@ -11,6 +11,9 @@ on:
     - examples/demo/**
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/dotnet-format.yml

@@ -14,6 +14,9 @@ on:
   merge_group:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   check-format:
     runs-on: windows-latest

.github/workflows/format-native.yml

@@ -7,6 +7,9 @@ on:
   merge_group:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   check-native-format:
     strategy:

.github/workflows/release-publish.yml

@@ -4,6 +4,9 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
 jobs:
   powershell-script:
     runs-on: windows-2022