Merge pull request #337 from CodebreakerApp/copilot/fix-d07782eb-4d00-4049-9ffe-62edc63f32f3

Add explicit permissions to all GitHub workflows following security best practices

Author: christiannagel

.github/workflows/codebreaker-azure.yml

@@ -72,6 +72,9 @@ jobs:
   set-staging-environmentvariables:
     runs-on: ubuntu-latest
     needs: [deploy-test]
+    permissions:
+      id-token: write
+      contents: read
     steps:
     - name: Azure Login
       uses: azure/login@v2

.github/workflows/codebreaker-lib-analyzers-stable.yml

@@ -5,6 +5,9 @@ on:
   # Allow manually trigger 
   workflow_dispatch:    
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/codebreaker-lib-analyzers.yml

@@ -13,6 +13,9 @@ on:
   # Allow manually trigger 
   workflow_dispatch:    
 
+permissions:
+  contents: read
+
 jobs:
   build:
     uses: CodebreakerApp/Codebreaker.Backend/.github/workflows/createnuget-withbuildnumber.yml@main

.github/workflows/codebreaker-lib-backendmodels-stable.yml

@@ -5,6 +5,9 @@ on:
   # Allow manually trigger 
   workflow_dispatch:    
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/codebreaker-lib-backendmodels.yml

@@ -13,6 +13,9 @@ on:
   # Allow manually trigger 
   workflow_dispatch:    
 
+permissions:
+  contents: read
+
 jobs:
   build:
     uses: CodebreakerApp/Codebreaker.Backend/.github/workflows/createnuget-withbuildnumber.yml@main

.github/workflows/codebreaker-lib-client-stable.yml

@@ -5,6 +5,9 @@ on:
   # Allow manually trigger 
   workflow_dispatch:    
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/codebreaker-lib-client.yml

@@ -13,6 +13,9 @@ on:
   # Allow manually trigger 
   workflow_dispatch:    
 
+permissions:
+  contents: read
+
 jobs:
   build:
     uses: CodebreakerApp/Codebreaker.Backend/.github/workflows/createnuget-withbuildnumber.yml@main

.github/workflows/codebreaker-lib-cosmos-stable.yml

@@ -5,6 +5,9 @@ on:
   # Allow manually trigger 
   workflow_dispatch:    
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/codebreaker-lib-cosmos.yml

@@ -13,6 +13,9 @@ on:
   # Allow manually trigger 
   workflow_dispatch:    
 
+permissions:
+  contents: read
+
 jobs:
   build:
     uses: CodebreakerApp/Codebreaker.Backend/.github/workflows/createnuget-withbuildnumber.yml@main

.github/workflows/codebreaker-lib-postgresql.yml

@@ -12,6 +12,9 @@ on:
   # Allow manually trigger 
   workflow_dispatch:    
 
+permissions:
+  contents: read
+
 jobs:
   build:
     uses: CodebreakerApp/Codebreaker.Backend/.github/workflows/createnuget-withbuildnumber.yml@main