Restrict permissions to github token for workflows (#2821)

Signed-off-by: Avgustin Marinov <Avgustin.Marinov@bosch.com>

.github/workflows/reusable_workflow_license-scan.yaml

@@ -16,6 +16,9 @@ on:
         description: 'GitLab API token for Dash IP lab (needed only if open_tickets is true)'
         required: false
 
+permissions:
+  contents: write
+
 jobs:
   reusable_workflow_license-scan:
     runs-on: ubuntu-latest

.github/workflows/reusable_workflow_tag.yaml

@@ -16,13 +16,13 @@ on:
         description: 'If to override the tag if already exists'
         default: false
 
+permissions:
+  contents: write
+
 jobs:
   tag:
     runs-on: ubuntu-latest
 
-    permissions:
-      contents: write
-
     steps:
       - uses: actions/checkout@v5
 

.github/workflows/reusable_workflow_trivy-scan.yaml

@@ -12,15 +12,15 @@ on:
         type: boolean
         default: false
 
+permissions:
+  contents: read
+  # needed for trivy scans upload
+  security-events: write
+
 jobs:
   trivy-scan:
     runs-on: ubuntu-latest
 
-    permissions:
-      contents: read
-      # needed for trivy scans upload
-      security-events: write
-
     steps:
       - name: Checkout code
         uses: actions/checkout@v5

.github/workflows/reusable_workflow_verify.yaml

@@ -16,6 +16,9 @@ on:
         default: ''
         description: 'Properties to pass to Maven command line, e.g. -Djpa.vendor=hibernate'
 
+permissions:
+  contents: read
+
 jobs:
   reusable_workflow_verify:
     runs-on: ubuntu-latest

.github/workflows/stale.yaml

@@ -6,6 +6,12 @@ on:
   schedule:
     - cron: "0 0 * * *"
 
+permissions:
+  contents: read
+  issues: write
+  # only needed if marking PRs as stale
+#  pull-requests: write
+
 jobs:
   stale:
     # only on original eclipse-hawkbit/hawkbit repo
@@ -16,12 +22,11 @@ jobs:
       - uses: actions/stale@v10
         with:
           repo-token: ${{ secrets.PAT_SECRET }}
+          # disables automatic marking of issues as stale
           days-before-stale: -1
           days-before-close: 15
           stale-issue-label: 'awaiting'
           close-issue-message: |-
             There has been no response from the original author so I closed this issue.
             Please reach out if you have or find the answers we need so that we can investigate further.
-          only-labels: 'awaiting'
+          only-labels: 'awaiting'
-          skip-stale-issue-message: 'true'
-          skip-stale-pr-message: 'true'