Apply CI permissions

.github/workflows/ci.yml

@@ -7,6 +7,8 @@ env:
   DOTNET_NOLOGO: true
   DOTNET_SDK_VERSION: 8.0
 
+permissions: {}
+
 jobs:
   main:
     strategy:

.github/workflows/code-quality.yml

@@ -6,17 +6,17 @@ env:
   DOTNET_CLI_TELEMETRY_OPTOUT: true
   DOTNET_NOLOGO: true
 
+permissions:
+  checks: write
+  contents: write
+  pull-requests: write
+  security-events: write
+
 jobs:
   main:
     if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
 
-    permissions:
-      checks: write
-      contents: write
-      pull-requests: write
-      security-events: write
-
     steps:
     - name: Checkout code
       if: github.event_name != 'pull_request'

.github/workflows/docker-ci.yml

@@ -5,6 +5,8 @@ on: [push, pull_request]
 env:
   PLATFORMS: linux/amd64,linux/arm,linux/arm64
 
+permissions: {}
+
 jobs:
   main:
     strategy:

.github/workflows/docker-publish-latest.yml

@@ -9,6 +9,9 @@ env:
   PLATFORMS: linux/amd64,linux/arm,linux/arm64
   TAG: latest
 
+permissions:
+  packages: write
+
 jobs:
   main:
     runs-on: ubuntu-latest

.github/workflows/docker-publish-main.yml

@@ -10,6 +10,9 @@ env:
   PLATFORMS: linux/amd64,linux/arm,linux/arm64
   TAG: main
 
+permissions:
+  packages: write
+
 jobs:
   main:
     runs-on: ubuntu-latest

.github/workflows/docker-publish-released.yml

@@ -10,6 +10,9 @@ env:
   PLATFORMS: linux/amd64,linux/arm,linux/arm64
   TAG: released
 
+permissions:
+  packages: write
+
 jobs:
   main:
     runs-on: ubuntu-latest

.github/workflows/publish.yml

@@ -4,10 +4,14 @@ on: [push, pull_request]
 
 env:
   CONFIGURATION: Release
+  DOTNET_CLI_TELEMETRY_OPTOUT: true
+  DOTNET_NOLOGO: true
   DOTNET_SDK_VERSION: 8.0
   NODE_JS_VERSION: 'lts/*'
   PLUGINS: ArchiSteamFarm.OfficialPlugins.ItemsMatcher ArchiSteamFarm.OfficialPlugins.MobileAuthenticator ArchiSteamFarm.OfficialPlugins.SteamTokenDumper
 
+permissions: {}
+
 jobs:
   publish-asf-ui:
     runs-on: ubuntu-latest
@@ -69,10 +73,6 @@ jobs:
 
     runs-on: ${{ matrix.os }}
 
-    env:
-      DOTNET_CLI_TELEMETRY_OPTOUT: true
-      DOTNET_NOLOGO: true
-
     steps:
     - name: Checkout code
       uses: actions/[email protected]
@@ -406,6 +406,9 @@ jobs:
     needs: publish-asf
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: write
+
     steps:
     - name: Checkout code
       uses: actions/[email protected]

.github/workflows/translations.yml

@@ -4,6 +4,9 @@ on:
   schedule:
   - cron: '55 1 * * *'
 
+permissions:
+  contents: write
+
 jobs:
   update:
     runs-on: ubuntu-latest