update tokens

Signed-off-by: Jorge Turrado <[email protected]>

.github/workflows/auto-add-issues-to-project.yml

@@ -3,6 +3,10 @@ on:
   issues:
     types:
       - opened
+
+permissions: 
+  contents: read
+
 jobs:
   track_issue:
     runs-on: ubuntu-latest

.github/workflows/fossa.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions: 
+  contents: read
+
 env:
   fossa-key: 9e722f2c8904586d61f97f0bf05a99e4 # This is a public key only for pushing, it's safe here
 

.github/workflows/main-build.yml

@@ -3,6 +3,9 @@ on:
   push:
     branches:
       - main
+permissions: 
+  contents: read
+
 jobs:
   build:
     name: build

.github/workflows/nightly-e2e.yml

@@ -3,6 +3,9 @@ on:
   schedule:
     - cron: "0 0 * * *"
 
+permissions: 
+  contents: read
+
 jobs:
   validate:
     uses: kedacore/keda/.github/workflows/template-main-e2e-test.yml@main

.github/workflows/pr-validation.yml

@@ -75,6 +75,9 @@ jobs:
         if: always()
 
   validate-dockerfiles:
+    permissions:
+      contents: read  # for dorny/paths-filter to fetch a list of changed files
+      pull-requests: read  # for dorny/paths-filter to read pull requests
     name: validate-dockerfiles - ${{ matrix.name }}
     runs-on: ${{ matrix.runner }}
     container: ghcr.io/kedacore/keda-tools:1.23.3
@@ -106,6 +109,9 @@ jobs:
         run: make docker-build
 
   validate-dev-container:
+    permissions:
+      contents: read  # for dorny/paths-filter to fetch a list of changed files
+      pull-requests: read  # for dorny/paths-filter to read pull requests
     name: Validate dev-container - ${{ matrix.name }}
     runs-on: ${{ matrix.runner }}
     container: ghcr.io/kedacore/keda-tools:1.23.3

.github/workflows/release-build.yml

@@ -3,6 +3,10 @@ on:
   push:
     tags:
       - "v*"
+
+permissions:  
+  contents: read
+
 jobs:
   build:
     name: Push Release

.github/workflows/static-analysis-codeql.yml

@@ -5,6 +5,9 @@ on:
     branches: ["main"]
   pull_request: {}
 
+permissions:  # added using https://github.com/step-security/secure-repo
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true

.github/workflows/template-smoke-tests.yml

@@ -12,6 +12,10 @@ on:
       kindImage:
         required: true
         type: string
+
+permissions:  
+  contents: read
+
 jobs:
   smoke-tests:
     name: Validate k8s-${{ inputs.kubernetesVersion }}

.github/workflows/template-trivy-scan.yml

@@ -31,6 +31,9 @@ on:
         required: true
         type: boolean
 
+permissions:  
+  contents: read
+
 jobs:
   trivy-scan:
     name: Trivy - ${{ inputs.runs-on }} - ${{ inputs.scan-type }} ${{ inputs.image-ref }}

.github/workflows/v1-build.yml

@@ -3,6 +3,10 @@ on:
   push:
     branches:
       - v1
+
+permissions:  
+  contents: read
+
 jobs:
   validate:
     name: Validate