Merge pull request #2765 from crazy-max/ci-fix-content-read

ci: keep contents read permissions in jobs

.github/workflows/build.yml

@@ -227,6 +227,8 @@ jobs:
   govulncheck:
     runs-on: ubuntu-24.04
     permissions:
+      # same as global permission
+      contents: read
       # required to write sarif report
       security-events: write
     steps:
@@ -372,6 +374,8 @@ jobs:
     runs-on: ubuntu-24.04
     if: ${{ github.ref == 'refs/heads/master' && github.repository == 'docker/buildx' }}
     permissions:
+      # same as global permission
+      contents: read
       # required to write sarif report
       security-events: write
     needs:

.github/workflows/codeql.yml

@@ -23,6 +23,7 @@ jobs:
   codeql:
     runs-on: ubuntu-24.04
     permissions:
+      contents: read
       actions: read
       security-events: write
     steps:

.github/workflows/labeler.yml

@@ -20,6 +20,9 @@ jobs:
   labeler:
     runs-on: ubuntu-latest
     permissions:
+      # same as global permission
+      contents: read
+      # required for writing labels
       pull-requests: write
     steps:
       -