chore: set explicit workflow permissions defaults

Author: paulbalandan

.github/workflows/reusable-coveralls.yml

@@ -8,6 +8,9 @@ on:
         type: string
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   coveralls:
     runs-on: ubuntu-24.04

.github/workflows/reusable-phpunit-test.yml

@@ -56,6 +56,9 @@ on:
         type: string
         required: false
 
+permissions:
+  contents: read
+
 env:
   NLS_LANG: 'AMERICAN_AMERICA.UTF8'
   NLS_DATE_FORMAT: 'YYYY-MM-DD HH24:MI:SS'

.github/workflows/reusable-serviceless-phpunit-test.yml

@@ -50,6 +50,9 @@ on:
         type: string
         required: false
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     name: ${{ inputs.job-name }}

.github/workflows/test-phpcpd.yml

@@ -22,6 +22,9 @@ on:
       - 'system/**.php'
       - '.github/workflows/test-phpcpd.yml'
 
+permissions:
+  contents: read
+
 jobs:
   phpcpd:
     uses: codeigniter4/.github/.github/workflows/phpcpd.yml@main

.github/workflows/test-psalm.yml

@@ -20,6 +20,9 @@ on:
       - 'psalm*'
       - '.github/workflows/test-psalm.yml'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Psalm Analysis

admin/starter/.github/workflows/phpunit.yml

@@ -5,6 +5,9 @@ on:
     branches:
       - develop
 
+permissions:
+  contents: read
+
 jobs:
   main:
     name: Build and test

admin/userguide/.github/workflows/deploy.yml

@@ -7,6 +7,8 @@ on:
     branches:
       - master
 
+permissions: {}
+
 jobs:
   build:
     runs-on: ubuntu-24.04