ci: Updated workflows to include permissions. (#4)

Author: jamesiarmes

.github/workflows/branch.yaml

@@ -5,6 +5,9 @@ on:
     branches-ignore:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: Lint updated files
@@ -24,23 +27,23 @@ jobs:
       - name: Init TFLint
         run: tflint --init
       - name: Run TFLint
-        run: tflint --format compact --recursive --config "$GITHUB_WORKSPACE/.tflint.hcl"
+        run: tflint --format compact --recursive
 
   trivy:
     name: Run security scan
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source code
         uses: actions/checkout@v4
-      - name: Run Trivy vulnarability scanner
-        uses: aquasecurity/trivy-action@master
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@0.30.0
         with:
           scan-type: config
           format: sarif
-          output: "trivy-results.sarif"
+          output: trivy-results.sarif
       - name: Parse SARIF file
         # Always run this step, even if a previous step failed.
         if: always()
         uses: Ayrx/sarif_to_github_annotations@v0.2.2
         with:
-          sarif_file: "trivy-results.sarif"
+          sarif_file: trivy-results.sarif

.github/workflows/codeql-analysis.yaml

@@ -20,11 +20,8 @@ jobs:
     # Consider using larger runners or machines with greater resources for possible analysis time improvements.
     runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
     permissions:
-      # required for all workflows
       security-events: write
-      # required to fetch internal or private CodeQL packs
       packages: read
-      # only required for workflows in private repositories
       actions: read
       contents: read
     strategy:

.github/workflows/main.yaml

@@ -5,10 +5,17 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+  security-events: write
+
 jobs:
   lint:
     name: Lint updated modules
     runs-on: ubuntu-latest
+    env:
+      # Required to avoid rate limiting when downloading plugins.
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - name: Checkout source code
         uses: actions/checkout@v4
@@ -24,7 +31,12 @@ jobs:
       - name: Init TFLint
         run: tflint --init
       - name: Run TFLint
-        run: tflint --format compact --recursive --config "$GITHUB_WORKSPACE/.tflint.hcl"
+        run: tflint --format sarif --recursive --config "$GITHUB_WORKSPACE/.tflint.hcl" > tflint-results.sarif
+      - name: Upload SARIF result
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: tflint-results.sarif
 
   trivy:
     name: Run security scan
@@ -33,14 +45,14 @@ jobs:
       - name: Checkout source code
         uses: actions/checkout@v4
       - name: Run Trivy vulnarability scanner
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@0.32.0
         with:
           scan-type: config
           format: sarif
-          output: "trivy-results.sarif"
+          output: trivy-results.sarif
       - name: Upload SARIF result
         # Always run this step, even if a previous step failed.
         if: always()
         uses: github/codeql-action/upload-sarif@v3
         with:
-          sarif_file: "trivy-results.sarif"
+          sarif_file: trivy-results.sarif

.github/workflows/release.yaml

@@ -1,6 +1,7 @@
 name: Release New Version
 
 on:
+  workflow_dispatch:
   push:
     branches:
       - main
@@ -12,6 +13,9 @@ jobs:
     name: Build new release
     runs-on: ubuntu-latest
     if: ${{ !startsWith(github.event.head_commit.message, 'bump:') }}
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Checkout source code
         uses: actions/checkout@v4
@@ -40,6 +44,8 @@ jobs:
     name: Release module
     runs-on: ubuntu-latest
     if: startsWith(github.event.head_commit.message, 'bump:')
+    permissions:
+      contents: write
     steps:
       - name: Checkout source code
         uses: actions/checkout@v4