Hopefully closes #43

.github/workflows/ci.yml

@@ -29,17 +29,18 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref || github.run_id}}
   cancel-in-progress: true
 
-permissions:
-  actions: read
-  checks: write
-  contents: read
-  id-token: write
-  packages: write
-  pages: write
-  security-events: write
+permissions: {}
 
 jobs:
   build:
+    permissions:
+      actions: read
+      checks: write
+      contents: read
+      packages: write
+      # pages: write
+      pull-requests: write  # Needed for test results comments
+      security-events: write
     strategy:
       matrix:
         CMAKE_C_COMPILER:
@@ -158,6 +159,7 @@ jobs:
         uses: mikepenz/action-junit-report@62516aa379bff6370c95fd5894d5a27fb6619d9b
         if: success() || failure()
         with:
+          comment: true
           report_paths: build/GTestOutputDir/**/*.junit.xml
           fail_on_failure: true
           include_passed: true

.github/workflows/dependency-review.yml

@@ -9,11 +9,12 @@
 name: 'Dependency Review'
 on: [pull_request, workflow_dispatch]
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   dependency-review:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner

.github/workflows/flawfinder.yml

@@ -16,13 +16,12 @@ on:
       - '*'
   workflow_dispatch:
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref || github.run_id}}
   cancel-in-progress: true
 
-permissions:
-  contents: read
-
 jobs:
   flawfinder:
     name: Flawfinder

.github/workflows/msvc.yml

@@ -27,8 +27,7 @@ env:
   # Path to the CMake build directory.
   build: '${{ github.workspace }}/build'
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   analyze:

.github/workflows/ossf-scorecard.yml

@@ -10,14 +10,14 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref || github.run_id}}
   cancel-in-progress: true
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   analysis:
     name: Scorecard analysis
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       # Needed for Code scanning upload
       security-events: write
       # Needed for GitHub OIDC token if publish_results is true