ci: set permissions and add dependabot

.github/dependabot.yml

@@ -0,0 +1,37 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "github-actions"
+    commit-message:
+      prefix: "ci"
+      include: "scope"
+
+  - package-ecosystem: "docker"
+    directory: "/docker"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "docker"
+    commit-message:
+      prefix: "docker"
+      include: "scope"
+
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "docker"
+    commit-message:
+      prefix: "docker"
+      include: "scope"

.github/workflows/asan.yml

@@ -1,5 +1,9 @@
 name: ASAN
 
+permissions:
+  contents: read
+  pull-requests: read
+
 on:
   pull_request: null
   push:

.github/workflows/clang-format.yml

@@ -1,5 +1,9 @@
 name: Clang-Format Check
 
+permissions:
+  contents: read
+  pull-requests: read
+
 on:
   pull_request: null
   push:

.github/workflows/docker.yml

@@ -1,4 +1,9 @@
 name: Docker
+
+permissions:
+  contents: read
+  pull-requests: read
+
 on: [workflow_dispatch]
 
 jobs:

.github/workflows/frankenphp.yml

@@ -1,5 +1,9 @@
 name: FrankenPHP
 
+permissions:
+  contents: read
+  pull-requests: read
+
 on:
   pull_request: null
   push:

.github/workflows/linux.yml

@@ -1,5 +1,9 @@
 name: Linux
 
+permissions:
+  contents: read
+  pull-requests: read
+
 on:
   pull_request: null
   push:

.github/workflows/tsan.yml

@@ -1,5 +1,9 @@
 name: ThreadSanitizer
 
+permissions:
+  contents: read
+  pull-requests: read
+
 on:
   pull_request: null
   push:

.github/workflows/ubsan.yml

@@ -1,5 +1,9 @@
 name: UBSAN
 
+permissions:
+  contents: read
+  pull-requests: read
+
 on:
   pull_request: null
   push:

.github/workflows/windows.yml

@@ -1,4 +1,9 @@
 name: Windows
+
+permissions:
+  contents: read
+  pull-requests: read
+
 on:
   release:
     types: [published]
@@ -11,9 +16,6 @@ on:
   schedule:
     - cron: "30 4 * * *"
 
-permissions:
-  contents: write
-
 jobs:
   get-extension-matrix:
     runs-on: ubuntu-latest
@@ -54,6 +56,8 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     if: ${{ github.event_name == 'release' }}
+    permissions:
+      contents: write
     steps:
       - name: Upload artifact to the release
         uses: php/php-windows-builder/release@e03e5d39879adaeb61ed2225f0f4eae7db8c1df8 #v1.8.1