some update

.github/workflows/build_docker_images.yml

@@ -16,11 +16,13 @@ on:
         required: true
 
 permissions:
-  contents: write # for uploading release artifacts
+  contents: read
 
 jobs:
   build-and-push-images:
     runs-on: ubuntu-22.04
+    permissions:
+      contents: write # for uploading release artifacts
 
     steps:
       - name: Checkout repository

.github/workflows/build_iwasm_release.yml

@@ -32,11 +32,14 @@ on:
         required: false
 
 permissions:
-  contents: write # for uploading release artifacts
+  contents: read
 
 jobs:
   build:
     runs-on: ${{ inputs.runner }}
+    permissions:
+      contents: write # for uploading release artifacts
+
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/build_llvm_libraries.yml

@@ -29,7 +29,6 @@ on:
 
 permissions:
   contents: read
-  actions: write # for uploading cached artifact
 
 jobs:
   build_llvm_libraries:
@@ -40,6 +39,9 @@ jobs:
       image: ${{ inputs.container_image }}
     outputs:
       key: ${{ steps.create_lib_cache_key.outputs.key}}
+    permissions:
+      contents: read
+      actions: write # for uploading cached artifact
 
     steps:
       - name: checkout

.github/workflows/build_wamr_lldb.yml

@@ -29,10 +29,12 @@ on:
         default: "https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-20/wasi-sdk-20.0-linux.tar.gz"
 
 permissions:
-  contents: write # for uploading release artifacts
+  contents: read
 
 jobs:
   try_reuse:
+    permissions:
+      contents: write # for uploading release artifacts
     uses: ./.github/workflows/reuse_latest_release_binaries.yml
     with:
       binary_name_stem: "wamr-lldb-${{ inputs.ver_num }}-${{ inputs.arch }}-${{ inputs.runner }}"
@@ -49,6 +51,9 @@ jobs:
       PYTHON_VERSION: '3.10'
       PYTHON_UBUNTU_STANDALONE_BUILD: https://github.com/indygreg/python-build-standalone/releases/download/20230507/cpython-3.10.11+20230507-x86_64-unknown-linux-gnu-install_only.tar.gz
       PYTHON_MACOS_STANDALONE_BUILD: https://github.com/indygreg/python-build-standalone/releases/download/20230507/cpython-3.10.11+20230507-x86_64-apple-darwin-install_only.tar.gz
+    permissions:
+      contents: write # for uploading release artifacts
+
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/build_wamr_sdk.yml

@@ -36,11 +36,14 @@ on:
         required: true
 
 permissions:
-  contents: write # for uploading release artifacts
+  contents: read
 
 jobs:
   build:
     runs-on: ${{ inputs.runner }}
+    permissions:
+      contents: write # for uploading release artifacts
+
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/build_wamr_vscode_ext.yml

@@ -15,11 +15,14 @@ on:
         required: true
 
 permissions:
-  contents: write # for uploading release artifacts
+  contents: read
 
 jobs:
   build:
     runs-on: ubuntu-22.04
+    permissions:
+      contents: write # for uploading release artifacts
+
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/build_wamrc.yml

@@ -32,11 +32,14 @@ on:
         required: false
 
 permissions:
-  contents: write # for uploading release artifacts
+  contents: read
 
 jobs:
   build:
     runs-on: ${{ inputs.runner }}
+    permissions:
+      contents: write # for uploading release artifacts
+
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/codeql.yml

@@ -20,9 +20,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  actions: read
   contents: read
-  security-events: write
 
 jobs:
   analyze:
@@ -42,6 +40,11 @@ jobs:
         language: [ 'cpp' ]
         # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby', 'swift' ]
 
+    permissions:
+      contents: read
+      actions: read
+      security-events: write
+
     steps:
     - name: Checkout repository
       uses: actions/checkout@v3

.github/workflows/compilation_on_android_ubuntu.yml

@@ -72,10 +72,12 @@ env:
 
 permissions:
   contents: read
-  actions: write
 
 jobs:
   build_llvm_libraries_on_ubuntu_2204:
+    permissions:
+      contents: read
+      actions: write
     uses: ./.github/workflows/build_llvm_libraries.yml
     with:
       os: "ubuntu-22.04"

.github/workflows/compilation_on_macos.yml

@@ -54,15 +54,20 @@ env:
 
 permissions:
   contents: read
-  actions: write
 
 jobs:
   build_llvm_libraries_on_intel_macos:
+    permissions:
+      contents: read
+      actions: write
     uses: ./.github/workflows/build_llvm_libraries.yml
     with:
       os: "macos-13"
       arch: "X86"
   build_llvm_libraries_on_arm_macos:
+    permissions:
+      contents: read
+      actions: write
     uses: ./.github/workflows/build_llvm_libraries.yml
     with:
       os: "macos-14"

.github/workflows/compilation_on_sgx.yml

@@ -56,10 +56,12 @@ env:
 
 permissions:
   contents: read
-  actions: write
 
 jobs:
   build_llvm_libraries:
+    permissions:
+      contents: read
+      actions: write
     uses: ./.github/workflows/build_llvm_libraries.yml
     with:
       os: "ubuntu-20.04"

.github/workflows/create_tag.yml

@@ -16,7 +16,7 @@ on:
         value: ${{ jobs.create_tag.outputs.new_tag}}
 
 permissions:
-  contents: write # create and push tags
+  contents: read
 
 jobs:
   create_tag:
@@ -25,6 +25,8 @@ jobs:
       minor_version: ${{ steps.preparation.outputs.minor_version }}
       new_ver: ${{ steps.preparation.outputs.new_ver }}
       new_tag: ${{ steps.preparation.outputs.new_tag }}
+    permissions:
+      contents: write # create and push tags
 
     steps:
       - uses: actions/checkout@v4

.github/workflows/nightly_run.yml

@@ -46,15 +46,20 @@ env:
 
 permissions:
   contents: read
-  actions: write
 
 jobs:
   build_llvm_libraries_on_ubuntu_2004:
+    permissions:
+      contents: read
+      actions: write
     uses: ./.github/workflows/build_llvm_libraries.yml
     with:
       os: "ubuntu-20.04"
       arch: "X86"
   build_llvm_libraries_on_ubuntu_2204:
+    permissions:
+      contents: read
+      actions: write
     uses: ./.github/workflows/build_llvm_libraries.yml
     with:
       os: "ubuntu-22.04"