workflow: Add top-level permissions

Set:
```
permissions:
  contents: read
```
as the default top-level permissions explicitly
to conform to recommended security practices e.g.
https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions

.github/workflows/PR-wip-checks.yaml

@@ -9,6 +9,9 @@ on:
       - labeled
       - unlabeled
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true

.github/workflows/actionlint.yaml

@@ -11,6 +11,9 @@ on:
     paths:
       - '.github/workflows/**'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true

.github/workflows/basic-ci-amd64.yaml

@@ -13,6 +13,9 @@ on:
         type: string
         default: ""
 
+permissions:
+  contents: read
+
 jobs:
   run-cri-containerd:
     strategy:

.github/workflows/basic-ci-s390x.yaml

@@ -13,6 +13,9 @@ on:
         type: string
         default: ""
 
+permissions:
+  contents: read
+
 jobs:
   run-cri-containerd:
     strategy:

.github/workflows/build-checks-preview-riscv64.yaml

@@ -12,6 +12,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 name: Build checks preview riscv64
 jobs:
   check:

.github/workflows/build-checks.yaml

@@ -5,6 +5,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 name: Build checks
 jobs:
   check:

.github/workflows/build-kata-static-tarball-amd64.yaml

@@ -21,6 +21,9 @@ on:
         type: string
         default: ""
 
+permissions:
+  contents: read
+
 jobs:
   build-asset:
     runs-on: ubuntu-22.04

.github/workflows/build-kata-static-tarball-arm64.yaml

@@ -21,6 +21,9 @@ on:
         type: string
         default: ""
 
+permissions:
+  contents: read
+
 jobs:
   build-asset:
     runs-on: ubuntu-22.04-arm

.github/workflows/build-kata-static-tarball-ppc64le.yaml

@@ -21,6 +21,9 @@ on:
         type: string
         default: ""
 
+permissions:
+  contents: read
+
 jobs:
   build-asset:
     permissions:

.github/workflows/build-kata-static-tarball-riscv64.yaml

@@ -21,6 +21,9 @@ on:
         type: string
         default: ""
 
+permissions:
+  contents: read
+
 jobs:
   build-asset:
     runs-on: riscv-builder

.github/workflows/build-kata-static-tarball-s390x.yaml

@@ -21,6 +21,9 @@ on:
         type: string
         default: ""
 
+permissions:
+  contents: read
+
 jobs:
   build-asset:
     runs-on: s390x

.github/workflows/cargo-deny-runner.yaml

@@ -11,6 +11,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   cargo-deny-runner:
     runs-on: ubuntu-22.04

.github/workflows/ci-coco-stability.yaml

@@ -8,6 +8,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   kata-containers-ci-on-push:
     permissions:

.github/workflows/ci-devel.yaml

@@ -2,6 +2,9 @@ name: Kata Containers CI (manually triggered)
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   kata-containers-ci-on-push:
     permissions:

.github/workflows/ci-nightly-s390x.yaml

@@ -3,6 +3,10 @@ on:
     - cron: '0 5 * * *'
 
 name: Nightly CI for s390x
+
+permissions:
+  contents: read
+
 jobs:
   check-internal-test-result:
     runs-on: s390x

.github/workflows/ci-nightly.yaml

@@ -7,6 +7,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   kata-containers-ci-on-push:
     permissions:

.github/workflows/ci-on-push.yaml

@@ -14,6 +14,9 @@ on:
       - reopened
       - labeled
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true

.github/workflows/ci-weekly.yaml

@@ -16,6 +16,9 @@ on:
         type: string
         default: ""
 
+permissions:
+  contents: read
+
 jobs:
   build-kata-static-tarball-amd64:
     uses: ./.github/workflows/build-kata-static-tarball-amd64.yaml

.github/workflows/ci.yaml

@@ -20,6 +20,9 @@ on:
         type: string
         default: no
 
+permissions:
+  contents: read
+
 jobs:
   build-kata-static-tarball-amd64:
     uses: ./.github/workflows/build-kata-static-tarball-amd64.yaml

.github/workflows/cleanup-resources.yaml

@@ -4,6 +4,9 @@ on:
     - cron: "0 0 * * *"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   cleanup-resources:
     runs-on: ubuntu-22.04

.github/workflows/codeql.yml

@@ -19,6 +19,9 @@ on:
   schedule:
     - cron: '45 0 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})

.github/workflows/commit-message-check.yaml

@@ -6,6 +6,9 @@ on:
       - reopened
       - synchronize
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true

.github/workflows/darwin-tests.yaml

@@ -6,6 +6,9 @@ on:
       - reopened
       - synchronize
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true

.github/workflows/docs-url-alive-check.yaml

@@ -2,6 +2,9 @@ on:
   schedule:
     - cron:  '0 23 * * 0'
 
+permissions:
+  contents: read
+
 name: Docs URL Alive Check
 jobs:
   test:

.github/workflows/gatekeeper-skipper.yaml

@@ -31,6 +31,8 @@ on:
       skip_static:
         value: ${{ jobs.skipper.outputs.skip_static }}
 
+permissions:
+  contents: read
 
 jobs:
   skipper:

.github/workflows/gatekeeper.yaml

@@ -12,6 +12,9 @@ on:
       - reopened
       - labeled
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true

.github/workflows/kata-runtime-classes-sync.yaml

@@ -6,6 +6,9 @@ on:
       - reopened
       - synchronize
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true

.github/workflows/payload-after-push.yaml

@@ -5,6 +5,9 @@ on:
       - main
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
 

.github/workflows/publish-kata-deploy-payload.yaml

@@ -31,6 +31,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   kata-payload:
     runs-on: ${{ inputs.runner }}

.github/workflows/release-amd64.yaml

@@ -6,6 +6,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   build-kata-static-tarball-amd64:
     uses: ./.github/workflows/build-kata-static-tarball-amd64.yaml

.github/workflows/release-arm64.yaml

@@ -6,6 +6,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   build-kata-static-tarball-arm64:
     uses: ./.github/workflows/build-kata-static-tarball-arm64.yaml

.github/workflows/release-ppc64le.yaml

@@ -6,6 +6,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   build-kata-static-tarball-ppc64le:
     uses: ./.github/workflows/build-kata-static-tarball-ppc64le.yaml

.github/workflows/release-s390x.yaml

@@ -6,6 +6,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   build-kata-static-tarball-s390x:
     uses: ./.github/workflows/build-kata-static-tarball-s390x.yaml

.github/workflows/release.yaml

@@ -2,6 +2,9 @@ name: Release Kata Containers
 on:
   workflow_dispatch
 
+permissions:
+  contents: read
+
 jobs:
   release:
     runs-on: ubuntu-22.04

.github/workflows/run-cri-containerd-tests-ppc64le.yaml

@@ -1,4 +1,8 @@
 name: CI | Run cri-containerd tests on ppc64le
+
+permissions:
+  contents: read
+
 on:
   workflow_call:
     inputs:

.github/workflows/run-k8s-tests-on-aks.yaml

@@ -25,6 +25,9 @@ on:
         type: string
         default: ""
 
+permissions:
+  contents: read
+
 jobs:
   run-k8s-tests:
     strategy:

.github/workflows/run-k8s-tests-on-amd64.yaml

@@ -22,6 +22,9 @@ on:
         type: string
         default: ""
 
+permissions:
+  contents: read
+
 jobs:
   run-k8s-tests-amd64:
     strategy:

.github/workflows/run-k8s-tests-on-arm64.yaml

@@ -22,6 +22,9 @@ on:
         type: string
         default: ""
 
+permissions:
+  contents: read
+
 jobs:
   run-k8s-tests-on-arm64:
     strategy:

.github/workflows/run-k8s-tests-on-ppc64le.yaml

@@ -22,6 +22,9 @@ on:
         type: string
         default: ""
 
+permissions:
+  contents: read
+
 jobs:
   run-k8s-tests:
     strategy:

.github/workflows/run-k8s-tests-on-zvsi.yaml

@@ -22,6 +22,9 @@ on:
         type: string
         default: ""
 
+permissions:
+  contents: read
+
 jobs:
   run-k8s-tests:
     strategy:

.github/workflows/run-kata-coco-stability-tests.yaml

@@ -25,6 +25,9 @@ on:
         required: false
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   # Generate jobs for testing CoCo on non-TEE environments
   run-stability-k8s-tests-coco-nontee:

.github/workflows/run-kata-coco-tests.yaml

@@ -25,6 +25,9 @@ on:
         type: string
         default: ""
 
+permissions:
+  contents: read
+
 jobs:
   run-k8s-tests-on-tdx:
     strategy:

.github/workflows/run-kata-deploy-tests-on-aks.yaml

@@ -22,6 +22,9 @@ on:
         type: string
         default: ""
 
+permissions:
+  contents: read
+
 jobs:
   run-kata-deploy-tests:
     strategy:

.github/workflows/run-kata-deploy-tests.yaml

@@ -22,6 +22,9 @@ on:
         type: string
         default: ""
 
+permissions:
+  contents: read
+
 jobs:
   run-kata-deploy-tests:
     strategy:

.github/workflows/run-kata-monitor-tests.yaml

@@ -13,6 +13,9 @@ on:
         type: string
         default: ""
 
+permissions:
+  contents: read
+
 jobs:
   run-monitor:
     strategy:

.github/workflows/run-metrics.yaml

@@ -22,6 +22,9 @@ on:
         type: string
         default: ""
 
+permissions:
+  contents: read
+
 jobs:
   run-metrics:
     strategy:

.github/workflows/run-runk-tests.yaml

@@ -13,6 +13,9 @@ on:
         type: string
         default: ""
 
+permissions:
+  contents: read
+
 jobs:
   run-runk:
     # Skip runk tests as we have no maintainers. TODO: Decide when to remove altogether

.github/workflows/shellcheck.yaml

@@ -10,6 +10,9 @@ on:
       - reopened
       - synchronize
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true

.github/workflows/shellcheck_required.yaml

@@ -11,6 +11,9 @@ on:
       - reopened
       - synchronize
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true

.github/workflows/stale.yaml

@@ -4,6 +4,9 @@ on:
     - cron: '0 0 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   stale:
     runs-on: ubuntu-22.04

.github/workflows/static-checks-self-hosted.yaml

@@ -6,6 +6,9 @@ on:
       - reopened
       - labeled # a workflow runs only when the 'ok-to-test' label is added
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true

.github/workflows/static-checks.yaml

@@ -6,6 +6,9 @@ on:
       - reopened
       - synchronize
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true

src/runtime/pkg/govmm/.github/workflows/main.yml

@@ -1,5 +1,9 @@
 on: ["pull_request"]
 name: Unit tests
+
+permissions:
+  contents: read
+
 jobs:
   test:
     strategy: