Update workflow permissions

.devcontainer/debian-10/Dockerfile

@@ -1,4 +1,4 @@
-FROM debian:10
+FROM debian:10@sha256:46ca02d33c65ab188d6e56f26c323bf1aa9a99074f2f54176fdc3884304f58b8
 
 ARG CMAKE_VERSION="3.26.4"
 

.devcontainer/ubuntu-20.04/Dockerfile

@@ -1,4 +1,4 @@
-FROM ubuntu:20.04
+FROM ubuntu:20.04@sha256:ed4a42283d9943135ed87d4ee34e542f7f5ad9ecf2f244870e23122f703f91c2
 
 ARG CMAKE_VERSION="3.26.4"
 

.devcontainer/ubuntu-22.04/Dockerfile

@@ -1,4 +1,4 @@
-FROM ubuntu:22.04
+FROM ubuntu:22.04@sha256:2b7412e6465c3c7fc5bb21d3e6f1917c167358449fecac8176c6e496e5c1f05f
 
 ARG CMAKE_VERSION="3.26.4"
 

.github/dependabot.yaml

@@ -6,3 +6,18 @@ updates:
       interval: "weekly"
     open-pull-requests-limit: 10
     rebase-strategy: disabled
+
+  - package-ecosystem: docker
+    directory: /.devcontainer/debian-10
+    schedule:
+      interval: weekly
+
+  - package-ecosystem: docker
+    directory: /.devcontainer/ubuntu-20.04
+    schedule:
+      interval: weekly
+
+  - package-ecosystem: docker
+    directory: /.devcontainer/ubuntu-22.04
+    schedule:
+      interval: weekly

.github/workflows/buildmgr.yml

@@ -38,6 +38,8 @@ on:
   release:
     types: [ published ]
 
+permissions: read-all
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/codeql-analysis.yml

@@ -15,6 +15,8 @@ on:
   push:
     branches: [ main ]
 
+permissions: read-all
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/cpp-linter.yml

@@ -15,6 +15,8 @@ on:
       - '!**/docs/**/*'
       - '!**/*.md'
 
+permissions: read-all
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/global.yaml

@@ -3,6 +3,9 @@ on:
   pull_request:
   release:
     types: [ published ]
+
+permissions: read-all
+
 jobs:
   copyright:
     runs-on: ubuntu-22.04

.github/workflows/markdown.yml

@@ -6,6 +6,9 @@ on:
       - '.github/markdownlint.json'
       - '.github/markdownlint.jsonc'
       - '**/*.md'
+
+permissions: read-all
+
 jobs:
   markdown-lint:
     name: Lint markdown files

.github/workflows/nightly.yml

@@ -5,6 +5,8 @@ on:
   schedule:
     - cron: '0 0 * * *'
 
+permissions: read-all
+
 jobs:
   buildmgr:
     if: github.repository == 'Open-CMSIS-Pack/devtools'

.github/workflows/packchk.yml

@@ -36,6 +36,8 @@ on:
   release:
     types: [published]
 
+permissions: read-all
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/packgen.yml

@@ -31,6 +31,8 @@ on:
   release:
     types: [published]
 
+permissions: read-all
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/projmgr.yml

@@ -32,6 +32,8 @@ on:
   release:
     types: [published]
 
+permissions: read-all
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/shared_matrix_prep.yml

@@ -18,6 +18,8 @@ on:
       matrix:
         value: ${{ jobs.matrix_prep.outputs.matrix }}
 
+permissions: read-all
+
 jobs:
   matrix_prep:
     runs-on: ubuntu-22.04

.github/workflows/shared_setup_env.yml

@@ -16,6 +16,8 @@ on:
         description: 'Artifact retention days 7 when nightly, else 1'
         value: ${{ jobs.config.outputs.retention_days }}
 
+permissions: read-all
+
 jobs:
   config:
     runs-on: ubuntu-22.04

.github/workflows/svdconv.yml

@@ -28,6 +28,8 @@ on:
   release:
     types: [published]
 
+permissions: read-all
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/test_libs.yml

@@ -20,6 +20,8 @@ on:
       - '!**/docs/**/*'
       - '!**/*.md'
 
+permissions: read-all
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/unit_test_results.yml

@@ -10,12 +10,17 @@ on:
     types:
       - completed
 
+permissions: read-all
+
 jobs:
   publish-test-results:
     name: Publish Test Results
     runs-on: ubuntu-22.04
-    if: github.event.workflow_run.conclusion != 'skipped'
+    permissions:
+      checks: write
+      pull-requests: write
 
+    if: github.event.workflow_run.conclusion != 'skipped'
     steps:
       - name: Download and Extract Artifacts
         env: