Set explicit permissions for GitHub Actions workflows (#356)

Author: picatz

.github/workflows/build-gems.yml

@@ -5,6 +5,10 @@ on:
       - main
       - "releases/*"
 
+permissions:
+  contents: read
+  actions: write
+
 jobs:
   build-platform-gems:
     runs-on: ubuntu-latest

.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
       - main
       - "releases/*"
 
+permissions:
+  contents: read
+
 jobs:
   build-lint-test:
     strategy:

.github/workflows/run-bench.yml

@@ -1,10 +1,13 @@
 name: Run Bench
-on:
-  workflow_call:
-  workflow_dispatch:
-
-jobs:
-  run-bench:
+on:
+  workflow_call:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  run-bench:
     runs-on: ubuntu-latest-4-cores
     defaults:
       run:
@@ -47,4 +50,4 @@ jobs:
       - run: bundle exec ruby extra/simple_bench.rb --workflow-count 10000 --max-cached-workflows 10000 --max-concurrent 10000
 
       - run: bundle exec ruby extra/simple_bench.rb --workflow-count 10000 --max-cached-workflows 1000 --max-concurrent 1000
-      - run: bundle exec ruby extra/simple_bench.rb --workflow-count 10000 --max-cached-workflows 1000 --max-concurrent 1000
+      - run: bundle exec ruby extra/simple_bench.rb --workflow-count 10000 --max-cached-workflows 1000 --max-concurrent 1000