Merge pull request #3980 from sashashura/patch-1

GitHub Workflows security hardening

.github/workflows/CICD.yml

@@ -17,6 +17,9 @@ env:
 
 on: [push, pull_request]
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
 jobs:
   cargo-deny:
     name: Style/cargo-deny
@@ -532,6 +535,9 @@ jobs:
         path: size-result.json
 
   build:
+    permissions:
+      contents: write # to create GitHub release (softprops/action-gh-release)
+
     name: Build
     needs: [ min_version, deps ]
     runs-on: ${{ matrix.job.os }}

.github/workflows/GnuTests.yml

@@ -6,6 +6,9 @@ name: GnuTests
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   gnu:
     permissions: