GitHub Actions: Add permission:{} to reduce GITHUB_TOKEN leak attack surface

.github/workflows/callable-test-core-build-process.yml

@@ -20,6 +20,11 @@ on:
 env:
   PUPPETEER_SKIP_DOWNLOAD: ${{ true }}
 
+
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
+
 jobs:
   # Verifies that installing npm dependencies and building WordPress works as expected.
   #

.github/workflows/callable-test-gutenberg-build-process.yml

@@ -17,6 +17,11 @@ on:
         type: 'string'
         default: 'src'
 
+
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
+
 env:
   GUTENBERG_DIRECTORY: ${{ inputs.directory == 'build' && 'build' || 'src' }}/wp-content/plugins/gutenberg
   PUPPETEER_SKIP_DOWNLOAD: ${{ true }}

.github/workflows/phpunit-tests-run.yml

@@ -45,6 +45,12 @@ on:
         required: false
         type: 'boolean'
         default: false
+
+
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
+
 env:
   LOCAL_PHP: ${{ inputs.php }}-fpm
   LOCAL_DB_TYPE: ${{ inputs.db-type }}

.github/workflows/upgrade-testing-run.yml

@@ -37,6 +37,11 @@ on:
         type: 'string'
         default: '5.7'
 
+
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
+
 jobs:
   # Runs upgrade tests on a build of WordPress.
   #