GitHub Actions: Security hardening (#2882)

.github/workflows/docs.yml

@@ -14,6 +14,9 @@ on:
       - 'src/pretix/static/**'
       - 'src/tests/**'
 
+permissions:
+  contents: read  #  to fetch code (actions/checkout)
+
 jobs:
   spelling:
     name: Spellcheck

.github/workflows/strings.yml

@@ -12,6 +12,9 @@ on:
       - 'doc/**'
       - 'src/pretix/locale/**'
 
+permissions:
+  contents: read  #  to fetch code (actions/checkout)
+
 jobs:
   compile:
     runs-on: ubuntu-22.04

.github/workflows/style.yml

@@ -12,6 +12,9 @@ on:
       - 'src/pretix/locale/**'
       - 'src/pretix/static/**'
 
+permissions:
+  contents: read  #  to fetch code (actions/checkout)
+
 jobs:
   isort:
     name: isort

.github/workflows/tests.yml

@@ -12,6 +12,9 @@ on:
       - 'doc/**'
       - 'src/pretix/locale/**'
 
+permissions:
+  contents: read  #  to fetch code (actions/checkout)
+
 jobs:
   test:
     runs-on: ubuntu-22.04