ci: declare per-workflow permissions and move registry creds to environments

.github/workflows/container-validation.yml

@@ -5,6 +5,9 @@ on:
   pull_request:
     branches: [ master ]
 
+permissions:
+  contents: read
+
 jobs:
   simplerisk-jammy:
     name: 'Verify simplerisk/simplerisk image based on Ubuntu 22.04 (Jammy)'

.github/workflows/create_new_tag.yml

@@ -4,6 +4,9 @@ on:
   push:
     branches: [ "master" ]
 
+permissions:
+  contents: write   # git tag + git push --tags
+
 jobs:
   create-release:
     runs-on: ubuntu-latest

.github/workflows/promote-latest.yml

@@ -46,6 +46,7 @@ env:
 
 jobs:
   promote:
+    environment: release
     runs-on: ubuntu-latest
     steps:
       - name: Checkout

.github/workflows/publish-testing.yml

@@ -42,6 +42,7 @@ env:
 
 jobs:
   publish:
+    environment: testing
     runs-on: ubuntu-latest
     timeout-minutes: 40
     steps:

.github/workflows/push-to-dockerhub.yml

@@ -19,6 +19,9 @@ name: Push images to DockerHub
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 # On a job that uses a reusable workflow, it seems you cannot
 # use env on a with block (https://github.com/actions/runner/issues/1189#issuecomment-1741672276)
 env:

.github/workflows/push-to-dockerhub_rw.yml

@@ -42,6 +42,7 @@ on:
 
 jobs:
   dockerhub:
+    environment: release
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository

.github/workflows/push-to-gh-pkgs.yml

@@ -15,6 +15,11 @@ name: Push images to GitHub Packages
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+  packages: write   # callee push-to-gh-pkgs_rw pushes to ghcr.io
+  id-token: write   # callee cosign-signs via sigstore/fulcio
+
 # On a job that uses a reusable workflow, it seems you cannot
 # use env on a with block (https://github.com/actions/runner/issues/1189#issuecomment-1741672276)
 env:

.github/workflows/shellcheck.yml

@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: [ master ]
 
+permissions:
+  contents: read
+
 jobs:
   shellcheck:
     name: ShellCheck