build: update reusable workflows

.github/workflows/block-unconventional-commits.yml

@@ -4,6 +4,10 @@ on:
   pull_request:
     types: [opened, ready_for_review, reopened, synchronize]
 
+permissions:
+  contents: read
+  pull-requests: read
+
 concurrency:
   group: block-unconventional-commits-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true

.github/workflows/build-npm.yml

@@ -6,6 +6,10 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+  pull-requests: read
+
 concurrency:
   group: build-npm-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true

.github/workflows/lint-appinfo-xml.yml

@@ -6,6 +6,10 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+  pull-requests: read
+
 concurrency:
   group: lint-info-xml-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true

.github/workflows/lint-eslint.yml

@@ -6,6 +6,10 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+  pull-requests: read
+
 concurrency:
   group: lint-eslint-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true

.github/workflows/lint-openapi.yml

@@ -6,6 +6,10 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+  pull-requests: read
+
 concurrency:
   group: openapi-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true

.github/workflows/lint-php-cs.yml

@@ -6,6 +6,10 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+  pull-requests: read
+
 concurrency:
   group: lint-php-cs-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true

.github/workflows/lint-php.yml

@@ -6,6 +6,10 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+  pull-requests: read
+
 concurrency:
   group: lint-php-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true

.github/workflows/phpunit-incremental.yml

@@ -6,6 +6,10 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+  pull-requests: read
+
 concurrency:
   group: phpunit-incremental-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true

.github/workflows/phpunit-mysql.yml

@@ -6,6 +6,10 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+  pull-requests: read
+
 concurrency:
   group: phpunit-mysql-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true

.github/workflows/phpunit-pgsql.yml

@@ -6,6 +6,10 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+  pull-requests: read
+
 concurrency:
   group: phpunit-pgsql-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true

.github/workflows/psalm-matrix.yml

@@ -7,6 +7,10 @@ on:
   #   branches:
   #     - master
 
+permissions:
+  contents: read
+  pull-requests: read
+
 concurrency:
   group: psalm-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true

.github/workflows/vitest.yml

@@ -6,6 +6,10 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+  pull-requests: read
+
 concurrency:
   group: vitest-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true