ci: Explicit and more restrictive workflow permissions

Implements principle of least privilege

.github/workflows/build.yml

@@ -5,6 +5,8 @@ on:
   push:
   pull_request:
 
+permissions: read-all
+
 jobs:
   #############################################
   build-win:
@@ -153,6 +155,8 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      contents: write
     needs:
       - build-win
       - build-linux

.github/workflows/docker-hub.yml

@@ -9,6 +9,8 @@ on:
       - .github/workflows/docker-hub.yml
   workflow_dispatch:
 
+permissions: read-all
+
 jobs:
   readme:
     name: Update Repo Metadata

.github/workflows/inspect-code.yml

@@ -18,6 +18,8 @@ env:
               (github.event.base_ref || github.event.pull_request.base.ref || 'master') }}
   dotnetVersion: 9.0.x
 
+permissions: read-all
+
 jobs:
   inspect:
     name: Resharper Inspect Code

.github/workflows/markdown-lint.yml

@@ -17,6 +17,8 @@ on:
       - "!src/**"
       - "!tests/**"
 
+permissions: read-all
+
 jobs:
   markdownlint:
     name: Markdown Lint

.github/workflows/notify.yml

@@ -14,6 +14,8 @@ on:
 env:
   TAG: ${{ github.event.release.tag_name || github.event.inputs.tag_name }}
 
+permissions: read-all
+
 jobs:
   notify:
     name: Discord Notification

.github/workflows/reusable-build.yml

@@ -16,6 +16,8 @@ on:
 env:
   dotnetVersion: 9.0.x
 
+permissions: read-all
+
 jobs:
   build:
     name: Build, Test, Smoke

.github/workflows/reusable-docker.yml

@@ -5,6 +5,8 @@ on:
 env:
   SHOULD_PUBLISH: ${{ startsWith(github.ref, 'refs/tags/') || github.ref_name == 'master' }}
 
+permissions: read-all
+
 jobs:
   docker:
     name: Build & Push Docker Image

.github/workflows/sonarcloud.yml

@@ -27,6 +27,8 @@ on:
 env:
   dotnetVersion: 9.0.x
 
+permissions: read-all
+
 jobs:
   sonarcloud:
     name: SonarCloud