ci: set default permission to contents:read (#236)

.github/workflows/build_push_image.yml

@@ -11,6 +11,10 @@ on:
       - test/**
   workflow_dispatch:
 
+# Declare default permissions as read only.
+permissions:
+  contents: read
+
 jobs:
   build_push_android:
     permissions:

.github/workflows/pr_config.yml

@@ -5,6 +5,10 @@ on:
       - config/**
   workflow_dispatch:
 
+# Declare default permissions as read only.
+permissions:
+  contents: read
+
 jobs:
   validate_version:
     runs-on: ubuntu-22.04

.github/workflows/pr_docs.yml

@@ -6,6 +6,10 @@ on:
       - config/version.json
   workflow_dispatch:
 
+# Declare default permissions as read only.
+permissions:
+  contents: read
+
 jobs:
   build_docs:
     runs-on: ubuntu-22.04

.github/workflows/pr_flutter_app.yml

@@ -6,6 +6,10 @@ on:
       - version.json
   workflow_dispatch:
 
+# Declare default permissions as read only.
+permissions:
+  contents: read
+
 jobs:
   test_gradle:
     permissions:

.github/workflows/pr_image.yml

@@ -8,6 +8,9 @@ on:
       - script/set_environment_variables.sh
   workflow_dispatch:
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   test_image:
     permissions:

.github/workflows/scorecard.yml

@@ -15,7 +15,8 @@ on:
     branches: [ "main" ]
 
 # Declare default permissions as read only.
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   analysis:

.github/workflows/update_flutter_dependencies.yml

@@ -7,6 +7,10 @@ on:
       - config/flutter_version.json
   workflow_dispatch:
 
+# Declare default permissions as read only.
+permissions:
+  contents: read
+
 jobs:
   update_version:
     permissions:

.github/workflows/update_flutter_version.yml

@@ -2,6 +2,11 @@ on:
   schedule:
     - cron: '0 0 * * MON-FRI'
   workflow_dispatch:
+
+# Declare default permissions as read only.
+permissions:
+  contents: read
+
 jobs:
   update_flutter_version:
     permissions:

Dockerfile

@@ -7,7 +7,7 @@ ENV LANG=C.UTF-8
 # renovate: datasource=repology depName=debian_12/curl versioning=loose
 ARG CURL_VERSION="7.88.1-10+deb12u7"
 # renovate: datasource=repology depName=debian_12/git versioning=loose
-ARG GIT_VERSION="1:2.39.2-1.1"
+ARG GIT_VERSION="1:2.39.5-0+deb12u1"
 # renovate: datasource=repology depName=debian_12/lcov versioning=loose
 ARG LCOV_VERSION="1.16-1"
 # renovate: datasource=repology depName=debian_12/ca-certificates versioning=loose