CI: Minimize workflow permissions

.github/workflows/gamedb-lint.yml

@@ -16,6 +16,9 @@ on:
       - 'data/resources/discdb.yaml'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   gamedb-lint:
     runs-on: ubuntu-slim

.github/workflows/linux-appimage-build.yml

@@ -4,6 +4,9 @@ on:
   workflow_call:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   linux-appimage-build:
     name: "${{ matrix.name }}"

.github/workflows/linux-cross-appimage-build.yml

@@ -4,6 +4,9 @@ on:
   workflow_call:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: "${{ matrix.arch }}"

.github/workflows/macos-build.yml

@@ -4,6 +4,9 @@ on:
   workflow_call:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   macos-build:
     name: "Universal"

.github/workflows/main.yml

@@ -6,8 +6,8 @@ on:
     paths-ignore:
       - '**.md'
       - 'appveyor.yml'
+      - 'extras/yamllint-config.yaml'
       - 'scripts/*'
-      - '.github/ISSUE_TEMPLATE/*'
   push:
     branches:
       - master
@@ -15,8 +15,11 @@ on:
     paths-ignore:
       - '**.md'
       - 'appveyor.yml'
+      - 'extras/yamllint-config.yaml'
       - 'scripts/*'
-      - '.github/ISSUE_TEMPLATE/*'
+
+permissions:
+  contents: write
 
 jobs:
   windows:

.github/workflows/translation-lint.yml

@@ -12,6 +12,9 @@ on:
       - 'src/duckstation-qt/translations/*.ts'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   translation-lint:
     runs-on: ubuntu-slim

.github/workflows/upload-caches.yml

@@ -3,6 +3,9 @@ name: Upload Caches
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   upload-windows-cache:
     runs-on: windows-2022

.github/workflows/windows-build.yml

@@ -4,6 +4,9 @@ on:
   workflow_call:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   windows-build:
     name: "${{ matrix.name }}"