Harden GitHub actions

.github/workflows/container-image.yml

@@ -1,5 +1,8 @@
 name: Build container image
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     inputs:

.github/workflows/helm-chart-release.yml

@@ -4,6 +4,9 @@
 # of the `charts` directory.
 name: Release helm chart
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/installer-build.yml

@@ -1,5 +1,8 @@
 name: Build installer image, sign it, and generate SBOMs
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     outputs:

.github/workflows/manager-build.yml

@@ -1,5 +1,8 @@
 name: Build manager image, sign it, and generate SBOMs
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     outputs:

.github/workflows/sbom.yml

@@ -1,5 +1,7 @@
 name: Generate SBOMs
 
+permissions: {}
+
 on:
   workflow_call:
     inputs:

.github/workflows/sign-image.yml

@@ -1,5 +1,7 @@
 name: Sign image
 
+permissions: {}
+
 on:
   workflow_call:
     inputs: