Declare workflow permissions

Author: mbien

.github/workflows/main.yml

@@ -41,6 +41,11 @@ on:
   # keep in mind this will have ALL tests enabled
   workflow_dispatch:
 
+# read by default, jobs may request more
+permissions:
+  contents: read
+  actions: read
+
 # cancel other PR workflow run in the same head-base group if it exists (e.g. during PR syncs)
 # if this is not a PR run (no github.head_ref and github.base_ref defined), use an UID as group
 concurrency: 
@@ -134,6 +139,10 @@ jobs:
     name: Build Clusters on JDK ${{ matrix.java }}
     if: contains(github.event.pull_request.labels.*.name, 'ci:no-build') == false
     runs-on: ubuntu-latest
+    # cache and artifact upload
+    permissions:
+      contents: write
+      actions: write
     timeout-minutes: 40
     strategy:
       matrix:
@@ -2639,6 +2648,8 @@ jobs:
     #  * the workflow got cancelled
     if: ${{ always() && needs.base-build.result == 'success' && (!contains(needs.*.result, 'failure') || cancelled()) }}
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
     timeout-minutes: 60
     steps: