Pputman/update pr (#11203)

* test CI

* adding contents:read for the github permissions at the top level of all workflows

---------

Co-authored-by: Martín Volpe <[email protected]>
Co-authored-by: pputman12 <[email protected]>

.dockerignore

@@ -22,3 +22,4 @@ packages/web
 
 # Ignore generated credentials from google-github-actions/auth
 gha-creds-*.json
+

.github/workflows/celo-monorepo.yml

@@ -40,6 +40,9 @@ env:
 #  with:
 #    limit-access-to-actor: true
 
+permissions:
+  contents: read
+
 jobs:
   install-dependencies:
     name: Install dependencies

.github/workflows/containers.yaml

@@ -14,6 +14,9 @@ on:
       - 'packages/celotool/**'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   changed-files:
     runs-on: ubuntu-latest

.github/workflows/protocol-devchain.yml

@@ -7,6 +7,9 @@ on:
     - cron: 0 0 1 * *
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   generate-protocol-devchain:
     name: Generate protocol devchain used in celo-monorepo.yml workflow

.github/workflows/protocol_tests.yml

@@ -13,6 +13,9 @@ env:
   FOUNDRY_CACHE_KEY: 2
   ANVIL_PORT: 8546
 
+permissions:
+  contents: read
+
 jobs:
   check:
     defaults:

.github/workflows/publish-contracts-abi-release.yml

@@ -16,6 +16,10 @@ on:
         description: 'NPM TAG e.g. alpha, pre-merge (default: canary) '
         required: true
         type: string
+
+permissions:
+  contents: read
+
 jobs:
   publish:
     runs-on: ['self-hosted', 'org', 'npm-publish']

.github/workflows/stale.yml

@@ -9,6 +9,9 @@ on:
   schedule:
   - cron: '40 14 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   stale: