ci: use reusable QA workflows

.github/workflows/codeql.yaml

@@ -0,0 +1,23 @@
+---
+name: CodeQL
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: "34 0 * * 3"
+
+permissions:
+  contents: read
+jobs:
+  trigger:
+    uses: statnett/github-workflows/.github/workflows/codeql.yaml@main
+    with:
+      language: go
+    permissions:
+      actions: read
+      contents: read
+      security-events: write

.github/workflows/go-releaser.yml

@@ -1,11 +1,12 @@
 ---
 name: Go Releaser
-
 on:
   push:
     tags:
       - v*
 
+permissions:
+  contents: read
 jobs:
   goreleaser:
     runs-on: ubuntu-latest

.github/workflows/lint-pr.yml

@@ -1,13 +1,14 @@
 ---
 name: Lint PR
-
 on:
   pull_request_target:
     types:
       - opened
       - edited
       - synchronize
 
+permissions:
+  contents: read
 jobs:
   trigger:
     uses: statnett/github-workflows/.github/workflows/lint-pr.yaml@main

.github/workflows/release-please.yml

@@ -1,12 +1,13 @@
 ---
 name: Release Please
-
 on:
   push:
     branches:
       - main
   workflow_dispatch:
 
+permissions:
+  contents: read
 jobs:
   trigger:
     uses: statnett/github-workflows/.github/workflows/release-please.yaml@main

.github/workflows/scorecard.yaml

@@ -0,0 +1,20 @@
+---
+name: Scorecard supply-chain security
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: '20 7 * * 2'
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+jobs:
+  trigger:
+    uses: statnett/github-workflows/.github/workflows/scorecard.yaml@main
+    permissions:
+      security-events: write
+      id-token: write
+      contents: read
+      actions: read

.github/workflows/snapshot.yml

@@ -1,9 +1,10 @@
 ---
 name: Build Snapshot
-
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
 jobs:
   snapshot:
     name: Build Snapshot

.github/workflows/test.yml

@@ -1,9 +1,10 @@
 ---
 name: Test
-
 on:
   pull_request: {}
 
+permissions:
+  contents: read
 jobs:
   test:
     name: Test