Limit permission scope for workflows

Author: remcoder

.github/workflows/firebase-hosting-merge.yml

@@ -8,7 +8,12 @@ name: Deploy to Firebase Hosting on merge
       - develop
 jobs:
   build_and_deploy:
+    permissions:
+      contents: read
+      pull-requests: write
+    
     runs-on: ubuntu-latest
+    
     steps:
       - uses: actions/checkout@v4
       - run: npm ci && npm run predemo && npm run typedoc

.github/workflows/firebase-hosting-pull-request.yml

@@ -2,11 +2,21 @@
 # https://github.com/firebase/firebase-tools
 
 name: Deploy to Firebase Hosting on PR
-'on': pull_request
+
+on: 
+  pull_request_target:
+    branches: [ develop ]
+
 jobs:
   build_and_preview:
     if: '${{ github.event.pull_request.head.repo.full_name == github.repository }}'
+    
+    permissions:
+      contents: read
+      pull-requests: write
+
     runs-on: ubuntu-latest
+    
     steps:
       - uses: actions/checkout@v4
       - run: npm ci && npm run predemo && npm run typedoc

.github/workflows/npm-publish.yml

@@ -9,6 +9,9 @@ on:
 
 jobs:
   build:
+    permissions:
+      contents: read
+      
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

.github/workflows/run-tests.yml

@@ -6,13 +6,15 @@ name: Runs All Unit tests
 on:
   push:
     branches: [develop, releases]
-  pull_request:
+  pull_request_target:
     branches: [develop, releases]
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
+    runs-on: ubuntu-latest
 
     steps:
       - uses: actions/checkout@v4