ci(github): harden workflow permissions

.github/workflows/analyze-codeql.yaml

@@ -11,7 +11,6 @@ on:
 
 permissions:
   contents: read
-  security-events: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -21,6 +20,9 @@ jobs:
   analyze-codeql:
     name: Analyze
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      security-events: write
 
     steps:
     - name: Checkout Repository

.github/workflows/check-lint.yaml

@@ -19,6 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+
     steps:
       - name: Checkout
         uses: actions/checkout@v6

.github/workflows/check-scorecard.yaml

@@ -15,7 +15,6 @@ jobs:
     name: Analyze
     if: github.repository == 'zealdocs/zeal'
     runs-on: ubuntu-24.04
-
     permissions:
       security-events: write
       id-token: write

.github/workflows/lock.yaml

@@ -5,9 +5,7 @@ on:
     - cron: "0 0 * * *"
   workflow_dispatch:
 
-permissions:
-  issues: write
-  pull-requests: write
+permissions: {}
 
 concurrency:
   group: lock
@@ -17,6 +15,9 @@ jobs:
     name: Lock Old Issues
     if: github.repository == 'zealdocs/zeal'
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
 
     steps:
       - uses: dessant/lock-threads@v6

.github/workflows/release.yaml

@@ -5,8 +5,7 @@ on:
     tags:
       - "v*.*.*"
 
-permissions:
-  contents: write
+permissions: {}
 
 concurrency:
   group: ${{ github.workflow }}
@@ -16,6 +15,9 @@ jobs:
   build-windows:
     name: ${{ matrix.config.name }}
     runs-on: ${{ matrix.config.os }}
+    permissions:
+      contents: write
+
     strategy:
       fail-fast: false
       matrix:
@@ -98,6 +100,8 @@ jobs:
   build-appimage:
     name: AppImage
     runs-on: ubuntu-24.04
+    permissions:
+      contents: write
 
     steps:
       - name: Checkout
@@ -174,6 +178,9 @@ jobs:
   build-ubuntu:
     name: ${{ matrix.config.name }}
     runs-on: ${{ matrix.config.os }}
+    permissions:
+      contents: write
+
     strategy:
       fail-fast: false
       matrix: