ci: add explicit permissions blocks to all workflow files

.github/workflows/docker_img.yaml

@@ -34,6 +34,10 @@ on:
               type: boolean
               default: false
 
+permissions:
+    contents: read
+    packages: write
+
 jobs:
     build_images_base:
         name: Build Docker CHIP Build images - base

.github/workflows/lint.yml

@@ -30,6 +30,9 @@ concurrency:
         'workflow_dispatch' && github.run_number) || github.sha }}
     cancel-in-progress: true
 
+permissions:
+    contents: read
+
 jobs:
     code-lints:
         runs-on: ubuntu-latest

.github/workflows/minimal-build.yaml

@@ -26,6 +26,9 @@ concurrency:
     group: ${{ github.ref }}-${{ github.workflow }}-${{ (github.event_name == 'pull_request' && github.event.number) || (github.event_name == 'workflow_dispatch' && github.run_number) || github.sha }}
     cancel-in-progress: true
 
+permissions:
+    contents: read
+
 jobs:
     minimal-all-clusters:
         name: Linux / configure build of all-clusters-app

.github/workflows/mypy-validation.yml

@@ -31,6 +31,9 @@ on:
       - 'scripts/tests/chiptest/**/*.py'
       - 'scripts/tests/run_test_suite.py'
 
+permissions:
+  contents: read
+
 jobs:
   mypy-check:
     runs-on: ubuntu-latest

.github/workflows/pr-validation.yaml

@@ -4,6 +4,8 @@ on:
   pull_request:
     types: [opened, synchronize, reopened, edited]
 
+permissions: {}
+
 jobs:
   check_testing_header:
     runs-on: ubuntu-latest

.github/workflows/protocol_compatibility.yaml

@@ -18,6 +18,9 @@ on:
     paths:
       - "src/controller/data_model/controller-clusters.matter"
 
+permissions:
+  contents: read
+
 jobs:
   check_clusters_matter:
     name: Check controller-clusters.matter backwards compatibility

.github/workflows/qemu.yaml

@@ -29,6 +29,9 @@ concurrency:
 env:
     CHIP_LOG_TIMESTAMPS: false
 
+permissions:
+    contents: read
+
 jobs:
 
     qemu-esp32:

.github/workflows/release_artifacts.yaml

@@ -24,6 +24,9 @@ on:
 env:
     CHIP_LOG_TIMESTAMPS: false
 
+permissions:
+    contents: write
+
 jobs:
     esp32:
         name: ESP32

.github/workflows/restyled.yml

@@ -7,6 +7,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   restyled:
     runs-on: ubuntu-latest

.github/workflows/roll_and_build_docker.yaml

@@ -1,6 +1,10 @@
 name: Manually Roll, Build, and Push Docker Images
 on:
   workflow_dispatch:
+
+permissions:
+  contents: write
+
 jobs:
   roll_version:
     runs-on: ubuntu-latest

.github/workflows/smoketest-android.yaml

@@ -26,6 +26,9 @@ concurrency:
 env:
     CHIP_LOG_TIMESTAMPS: false
 
+permissions:
+    contents: read
+
 jobs:
     android:
         name: Smoke Run - Android

.github/workflows/spell.yml

@@ -27,6 +27,9 @@ on:
             - "**.md"
             - ".github/.wordlist.txt"
 
+permissions:
+    contents: read
+
 jobs:
     check-spellcheck:
         name: Check Spelling - pyspelling

.github/workflows/tag-releases.yaml

@@ -25,6 +25,10 @@ on:
     #     description: 'Branch'
     #     required: false
     #     type: string
+
+permissions:
+  contents: write
+
 jobs:
     tag_main_release:
         name: Tag Current Release

.github/workflows/tests.yaml

@@ -42,6 +42,9 @@ concurrency:
 env:
     CHIP_LOG_TIMESTAMPS: false
 
+permissions:
+    contents: read
+
 jobs:
     test_suites_linux:
         name: Test Suites - Linux

.github/workflows/third-party-check.yaml

@@ -23,6 +23,8 @@ on:
             - ".gitmodules"
         types: [opened, synchronize, reopened, labeled, unlabeled]
 
+permissions: {}
+
 jobs:
     check-submodule-update-label:
         name: Check For Submodule Update Label

.github/workflows/unit_integration_test.yaml

@@ -26,6 +26,9 @@ concurrency:
     group: ${{ github.ref }}-${{ github.workflow }}-${{ (github.event_name == 'pull_request' && github.event.number) || (github.event_name == 'workflow_dispatch' && github.run_number) || github.sha }}
     cancel-in-progress: true
 
+permissions:
+    contents: read
+
 jobs:
     unit_tests:
         name: Unit / Integration Tests

.github/workflows/zap_regeneration.yaml

@@ -24,6 +24,9 @@ concurrency:
 env:
     CHIP_LOG_TIMESTAMPS: false
 
+permissions:
+    contents: read
+
 jobs:
     zap_regeneration:
         name: ZAP Regeneration

.github/workflows/zap_templates.yaml

@@ -29,6 +29,9 @@ concurrency:
 env:
     CHIP_LOG_TIMESTAMPS: false
 
+permissions:
+    contents: read
+
 jobs:
     zap_templates:
         name: ZAP templates generation