Potential fix for code scanning alerts: Workflow does not contain permissions (#1234)

Signed-off-by: Álex Ruiz Becerra <alex-r-b@hotmail.com>
Signed-off-by: Jorge Sánchez <jorge.sanchez@wazuh.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Jorge Sánchez <jorge.sanchez@wazuh.com>

.github/workflows/5_builderpackage_docker.yml

@@ -84,6 +84,8 @@ jobs:
     secrets: inherit
 
   build-and-push-docker-image:
+    permissions:
+      contents: read
     needs: [call-build-workflow]
     runs-on: ubuntu-24.04
     env:

.github/workflows/5_builderpackage_indexer.yml

@@ -1,6 +1,9 @@
 run-name: Build ${{ inputs.distribution }} Wazuh Indexer on ${{ inputs.architecture }} | ${{ inputs.id }}
 name: (5.x) Build packages
 
+permissions:
+  contents: read
+
 # This workflow runs when any of the following occur:
 # - Run manually
 # - Invoked from another workflow

.github/workflows/5_codequality_changelog.yml

@@ -3,6 +3,8 @@ on:
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled]
 
+permissions:
+  contents: read
 jobs:
   # Enforces the update of a changelog file on every pull request
   verify-changelog:

.github/workflows/5_codequality_email.yml

@@ -1,4 +1,6 @@
 name: (5.x) Check email
+permissions:
+  contents: read
 on:
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled]

.github/workflows/5_testunit_version.yml

@@ -1,4 +1,6 @@
 name: (5.x) Check version file
+permissions:
+  contents: read
 
 on:
   push:

.github/workflows/6_builderpackage_indexer.yml

@@ -1,5 +1,7 @@
 run-name: Build ${{ inputs.distribution }} Wazuh Indexer on ${{ inputs.architecture }} | ${{ inputs.id }}
 name: (6.x) Build packages
+permissions:
+  contents: read
 
 # This workflow runs when any of the following occur:
 # - Run manually

.github/workflows/links.yml

@@ -3,6 +3,8 @@ on:
   schedule:
     - cron: "00 8 * * 5"
 
+permissions:
+  contents: read
 jobs:
   linkchecker:
     runs-on: ubuntu-24.04

CHANGELOG.md

@@ -62,5 +62,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - Reduce risk of GITHUB_TOKEN exposure [(#960)](https://github.com/wazuh/wazuh-indexer/pull/960)
 - Use latest Amazon Linux 2023 Docker image [(#1182)](https://github.com/wazuh/wazuh-indexer/pull/1182)
 - Update CodeQL configuration [(#1220)](https://github.com/wazuh/wazuh-indexer/pull/1220)
+- Potential fix for code scanning alerts: Workflow does not contain permissions [(#1234)](https://github.com/wazuh/wazuh-indexer/pull/1234)
 
 [Unreleased 5.0.0]: https://github.com/wazuh/wazuh-indexer/compare/4.14.1...5.0.0