workflow: stricter permissions

Author: dai-shi

.github/workflows/compressed-size.yml

@@ -2,9 +2,15 @@ name: Compressed Size
 
 on: [pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   compressed_size:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0

.github/workflows/preview-release.yml

@@ -2,9 +2,15 @@ name: Preview Release
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   preview_release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0

.github/workflows/test-multiple-builds.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     types: [opened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   test_multiple_builds:
     runs-on: ubuntu-latest

.github/workflows/test-multiple-versions.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     types: [opened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   test_multiple_versions:
     runs-on: ubuntu-latest
@@ -41,5 +44,7 @@ jobs:
           sed -i~ 's/import\.meta\.env[?]\.MODE/"DEVELOPMENT".toLowerCase()/' src/*.ts src/*/*.ts src/*/*/*.ts
       - name: Test ${{ matrix.react }}
         run: |
-          pnpm add -D react@${{ matrix.react }} react-dom@${{ matrix.react }}
+          pnpm add -D react@$REACT_VER react-dom@$REACT_VER
           pnpm run test:spec
+        env:
+          REACT_VER: ${{ matrix.react }}

.github/workflows/test-old-typescript.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     types: [opened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   test_old_typescript:
     runs-on: ubuntu-latest
@@ -46,10 +49,11 @@ jobs:
           sed -i~ 's/"verbatimModuleSyntax": true,//' tsconfig.json
       - name: Patch for specific TS version
         run: |
-          ts_ver_esc=${{ matrix.typescript }}
-          ts_ver_esc=${ts_ver_esc//./\\.}
+          ts_ver_esc=${TS_VER//./\\.}
           sed -i~ "s/\/\/ @ts-expect-error .*\[SKIP-TS-${ts_ver_esc}\].*//" src/*/*.ts src/*/*/*.ts
           sed -i~ "s/\/\/ .*\[ONLY-TS-${ts_ver_esc}\].* @ts-/\/\/ @ts-/" src/*/*.ts src/*/*/*.ts
+        env:
+          TS_VER: ${{ matrix.typescript }}
       - name: Patch for Old TS
         if: ${{ matrix.typescript == '5.5.4' || matrix.typescript == '5.4.5' || matrix.typescript == '5.3.3' || matrix.typescript == '5.2.2' || matrix.typescript == '5.1.6' || matrix.typescript == '5.0.4' || matrix.typescript == '4.9.5' || matrix.typescript == '4.8.4' || matrix.typescript == '4.7.4' || matrix.typescript == '4.6.4' || matrix.typescript == '4.5.5' }}
         run: |
@@ -65,6 +69,8 @@ jobs:
           pnpm add -D @types/node@18.13.0
           pnpm add -D vitest@3.2.4 @vitest/coverage-v8@3.2.4 @vitest/ui@3.2.4
       - name: Install old TypeScript
-        run: pnpm add -D typescript@${{ matrix.typescript }}
+        run: pnpm add -D typescript@$TS_VER
+        env:
+          TS_VER: ${{ matrix.typescript }}
       - name: Test ${{ matrix.typescript }}
         run: pnpm run test:types

.github/workflows/test.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     types: [opened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest