set token permissions for workflows (#1436)

* token permisstions for workflows

.github/workflows/build-containers-test.yaml

@@ -3,6 +3,9 @@ name: Build the containers
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 defaults:
   run:
     shell: bash

.github/workflows/client-pypi-release.yaml

@@ -5,6 +5,8 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
 
 jobs:
   release-package:

.github/workflows/client-verify.yaml

@@ -3,6 +3,9 @@ name: Client verify process
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   verify-client:
     name: lint, test

.github/workflows/docs-verify.yaml

@@ -3,6 +3,9 @@ name: Verify building sphinx docs
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   verify_docs_build:
     runs-on: ubuntu-latest

.github/workflows/gateway-verify.yaml

@@ -3,6 +3,9 @@ name: Gateway verify process
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   verify-gateway:
     name: lint, test, coverage

.github/workflows/helm-verify.yaml

@@ -8,6 +8,9 @@ on:
       - ".github/actions/helm-lint/action.yaml"
       - ".github/workflows/helm-verify.yaml"
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest

.github/workflows/icr-image-build-and-push.yaml

@@ -9,6 +9,9 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
 jobs:
   icr_build_and_push:
     runs-on: ubuntu-latest

.github/workflows/kubernetes-deploy.yaml

@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     runs-on: ubuntu-latest

.github/workflows/notebook-local-verify.yaml

@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     runs-on: ubuntu-latest

.github/workflows/proxy-verify.yaml

@@ -3,6 +3,9 @@ name: Proxy verify process
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   verify-proxy:
     name: lint, test

.github/workflows/publish-docs.yaml

@@ -6,9 +6,14 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   build_and_deploy_docs:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v3
       - uses: actions/setup-python@v4

.github/workflows/publish-helm.yaml

@@ -4,6 +4,9 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
 jobs:
   package:
     runs-on: ubuntu-latest

.github/workflows/release-drafter.yml

@@ -5,6 +5,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   update_release_draft:
     runs-on: ubuntu-latest

.github/workflows/update-component-versions.yaml

@@ -7,6 +7,9 @@ on:
         description: 'version to update to ("x.y.z" -- do not include a `v` prefix)'
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   update_component_versions:
     runs-on: ubuntu-latest