chore: Set permissions for GitHub actions

.github/workflows/ship-linux.yml

@@ -9,8 +9,13 @@ on:
       - test*
       - v*
 
+permissions:
+  contents: read
+
 jobs:
   ship-linux-installer:
+    permissions:
+      contents: write  # for softprops/action-gh-release to create GitHub release
     runs-on: ${{ matrix.os }}
     env:
       TERM: xterm

.github/workflows/ship-macos.yml

@@ -9,8 +9,13 @@ on:
       - test*
       - v*
 
+permissions:
+  contents: read
+
 jobs:
   ship-macos-installer:
+    permissions:
+      contents: write  # for softprops/action-gh-release to create GitHub release
     runs-on: ${{ matrix.os }}
     env:
       APPLE_CERT_DATA: ${{ secrets.APPLE_CERT_DATA }}

.github/workflows/ship-windoze.yml

@@ -8,8 +8,13 @@ on:
     tags:
       - test*
       - v*
+permissions:
+  contents: read
+
 jobs:
   ship-windows-installer:
+    permissions:
+      contents: write  # for softprops/action-gh-release to create GitHub release
     runs-on: ${{ matrix.os }}
     env:
       WINDOZE_CERT_DATA: ${{ secrets.WINDOZE_CERT_DATA }}

.github/workflows/update-submodules.yml

@@ -3,8 +3,13 @@ on:
   schedule:
     - cron: '8 14 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   auto-update-submodules:
+    permissions:
+      contents: write  # for Git to git push
     runs-on: ${{ matrix.os }}
     env:
       TERM: xterm