Set least-privilege GITHUB_TOKEN permissions in workflows

Add an explicit top-level permissions block to the GitHub Actions
workflows that were relying on the default token permissions. Each
workflow now defaults to contents: read, with additional scopes granted
only where a job needs them:

* nightly-trivy-scan keeps security-events: write at the job level to
  upload SARIF results, plus contents: read for checkout.
* stale-issues gets issues: write and pull-requests: write for the
  actions/stale action to label and close stale items.

Setting least-privilege permissions reduces the blast radius if a
workflow or one of its dependencies is compromised, and satisfies the
CLOMonitor token_permissions check.

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>

.github/workflows/get-go-version.yaml

@@ -10,6 +10,9 @@ on:
         description: "The expected Go version"
         value: ${{ jobs.extract.outputs.version }}
 
+permissions:
+  contents: read
+
 jobs:
   extract:
       runs-on: ubuntu-latest

.github/workflows/nightly-trivy-scan.yml

@@ -3,6 +3,9 @@ on:
   schedule:
     - cron: '0 2 * * *' # run at 2 AM UTC
 
+permissions:
+  contents: read
+
 jobs:
   nightly-scan:
     name: Trivy nightly scan
@@ -15,6 +18,7 @@ jobs:
         # list of images that need scan
         images: [velero, velero-plugin-for-aws, velero-plugin-for-gcp, velero-plugin-for-microsoft-azure]
     permissions:
+      contents: read  # for actions/checkout to fetch code
       security-events: write  # for github/codeql-action/upload-sarif to upload SARIF results
 
     steps:

.github/workflows/pr-ci-check.yml

@@ -1,5 +1,9 @@
 name: Pull Request CI Check
 on: [pull_request]
+
+permissions:
+  contents: read
+
 jobs:
   get-go-version:
     uses: ./.github/workflows/get-go-version.yaml

.github/workflows/pr-codespell.yml

@@ -1,5 +1,9 @@
 name: Pull Request Codespell Check
 on: [pull_request]
+
+permissions:
+  contents: read
+
 jobs:
 
   codespell:

.github/workflows/pr-containers.yml

@@ -9,6 +9,9 @@ on:
       - 'Dockerfile'
       - 'Dockerfile-Windows'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build

.github/workflows/pr-filepath-check.yml

@@ -1,5 +1,9 @@
 name: Pull Request File Path Check
 on: [pull_request]
+
+permissions:
+  contents: read
+
 jobs:
 
   filepath-check:

.github/workflows/pr-goreleaser.yml

@@ -9,6 +9,9 @@ on:
       - '.goreleaser.yml'
       - 'hack/release-tools/goreleaser.sh'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build

.github/workflows/pr-linter-check.yml

@@ -6,6 +6,10 @@ on:
       - "site/**"
       - "design/**"
       - "**/*.md"
+
+permissions:
+  contents: read
+
 jobs:
   get-go-version:
     uses: ./.github/workflows/get-go-version.yaml

.github/workflows/push-builder.yml

@@ -6,6 +6,9 @@ on:
     paths:
     - 'hack/build-image/Dockerfile'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build

.github/workflows/stale-issues.yml

@@ -3,6 +3,11 @@ on:
   schedule:
     - cron: "30 1 * * *" # Every day at 1:30 UTC
 
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
 jobs:
   stale:
     if: github.repository == 'velero-io/velero'