Set GitHub workflow permissions explicitly (#9432)

* Potential fix for code scanning alert no. 7: Workflow does not contain permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Potential fix for code scanning alert no. 9: Workflow does not contain permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Potential fix for code scanning alert no. 10: Workflow does not contain permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Potential fix for code scanning alert no. 19: Workflow does not contain permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Potential fix for code scanning alert no. 20: Workflow does not contain permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Set permissions in GitHub workflow jobs

---------

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

.github/workflows/coverage.yml

@@ -5,6 +5,9 @@ on:
   schedule:
     - cron: "0 0 * * *" # Every day at midnight UTC
 
+permissions:
+  contents: read
+
 env:
   UV_VERSION: 0.9.17
 

.github/workflows/dev-docker-image-build-gpu.yml

@@ -3,9 +3,15 @@ name: Build and push a branch gpu image to ghcr
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   branch-gpu-build-and-push:
     runs-on: [self-hosted, linux, x64]
+    permissions:
+      contents: read
+      packages: write
     steps:
         - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
           with:

.github/workflows/dev-docker-image-build.yml

@@ -9,10 +9,16 @@ on:
   repository_dispatch:
     types: [benchmark-trigger-image-build]
 
+permissions:
+  contents: read
+
 jobs:
   branch-build-and-push:
     if: ${{ !github.event.client_payload.triggered }}
     runs-on: [self-hosted, linux, x64]
+    permissions:
+      contents: read
+      packages: write
     steps:
         - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
           with:
@@ -30,6 +36,9 @@ jobs:
   triggered-branch-build-and-push:
     if: ${{ github.event.client_payload.triggered }}
     runs-on: [self-hosted, linux, x64]
+    permissions:
+      contents: read
+      packages: write
     steps:
         - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
           with:

.github/workflows/dev-docker-image-prune.yml

@@ -5,6 +5,8 @@ on:
   schedule:
     - cron: "0 0 * * *"  # every day at midnight
 
+permissions:
+  packages: write
 
 jobs:
   dev-clean-ghcr:

.github/workflows/edge-py-release.yml

@@ -9,6 +9,8 @@ on:
         default: false
         required: true
 
+permissions:
+  contents: read
 
 jobs:
   edge-py-linux:

.github/workflows/edge-rust-release.yml

@@ -9,6 +9,8 @@ on:
         default: false
         required: true
 
+permissions:
+  contents: read
 
 jobs:
   edge-rust-check:

.github/workflows/edge-test.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ '**' ]
 
+permissions:
+  contents: read
+
 jobs:
   edge-test:
     name: Test Qdrant Edge

.github/workflows/integration-tests.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ '**' ]
 
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
   UV_VERSION: 0.9.17

.github/workflows/io-bridge-object-store-tests.yml

@@ -13,6 +13,9 @@ on:
       - "lib/common/common/src/universal_io/**"
       - ".github/workflows/io-bridge-object-store-tests.yml"
 
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
 

.github/workflows/long-e2e-tests.yml

@@ -5,6 +5,9 @@ on:
     - cron: '30 6 * * *'  # At 06:30
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
   UV_VERSION: 0.9.17

.github/workflows/rust-gpu.yml

@@ -5,6 +5,9 @@ on:
   push:
     branches: [ master ]
 
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
 

.github/workflows/rust-lint.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ '**' ]
 
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
 

.github/workflows/rust.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ '**' ]
 
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always