ci: Harden GitHub Actions

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>

.github/workflows/argos.yaml

@@ -39,6 +39,9 @@ on:
       - 'website/**'
       - 'website-argos/**'
 
+permissions:
+  contents: read
+
 jobs:
   take-screenshots:
     name: take screenshots

.github/workflows/codecov-next.yaml

@@ -23,6 +23,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   codecov:
     name: Run tests and push coverage result

.github/workflows/merge-group.yaml

@@ -19,6 +19,9 @@ name: merge-queue
 on:
   merge_group:
 
+permissions:
+  contents: read
+
 jobs:
   dco:
     name: DCO

.github/workflows/publish-flathub.yaml

@@ -26,9 +26,14 @@ on:
   repository_dispatch:
     types: [ publish-to-flathub ]
 
+permissions:
+  contents: read
+
 jobs:
 
   update-flathub:
+    permissions:
+      contents: write  # for Git to git push
     name: Publish Podman Desktop to flathub
     runs-on: ubuntu-24.04
     steps:

.github/workflows/publish-to-brew.yaml

@@ -26,6 +26,9 @@ on:
   repository_dispatch:
     types: [ publish-to-brew ]
 
+permissions:
+  contents: read
+
 jobs:
 
   publish-to-brew:

.github/workflows/publish-to-chocolatey.yaml

@@ -30,6 +30,9 @@ on:
   repository_dispatch:
     types: [ publish-to-chocolatey ]
 
+permissions:
+  contents: read
+
 jobs:
 
   version:
@@ -56,6 +59,8 @@ jobs:
           echo "desktopVersion=$version" >> ${GITHUB_OUTPUT}
 
   winget-bump:
+    permissions:
+      contents: write  # for Git to git push
     name: Update Chocolatey
     needs: version
     runs-on: windows-2022

.github/workflows/publish-to-podman_io.yaml

@@ -21,11 +21,16 @@ on:
   workflow_dispatch:
     inputs:
       version:
+        permissions:
+          contents: write  # for Git to git push
         description: 'release version like 1.1.0'
         required: true
   repository_dispatch:
     types: [ publish-to-podman_io ]
 
+permissions:
+  contents: read
+
 jobs:
 
   version:

.github/workflows/publish-to-winget.yaml

@@ -26,6 +26,9 @@ on:
   repository_dispatch:
     types: [ publish-to-winget ]
 
+permissions:
+  contents: read
+
 jobs:
 
   version:

.github/workflows/website-next.yaml

@@ -32,8 +32,13 @@ on:
 env:
   GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
 
+permissions:
+  contents: read
+
 jobs:
   deploy:
+    permissions:
+      contents: write  # for peaceiris/actions-gh-pages to push pages branch
     name: Build and deploy website
     runs-on: ubuntu-24.04
     timeout-minutes: 60