Set read-only workflow permissions

[pnacht]

Currently, cpuinfo's build.yml workflow runs with write-all permissions. This is dangerous, since it opens the project up to supply-chain attacks. GitHub itself recommends ensuring all workflows run with minimal permissions.

The workflow seems to only build the package in different architectures, and as such doesn't require broad permissions.

This issue can be solved in two ways:

• add top-level read-only permissions to the workflow; and/or
• set the default token permissions to read-only in the repo settings.

I'll be sending a PR along with this issue that sets the top-level permissions. If you instead (or also) wish to modify the default token permissions:

1. Open the repo settings
2. Go to Actions > General
3. Under "Workflow permissions", set them to "Read repository contents and packages permissions"

---

Disclosure: My name is Pedro and I work with Google and the Open Source Security Foundation (OpenSSF) to improve the supply-chain security of the open-source ecosystem.

[Maratyszcza]

@malfet Can you set the default token permissions?

[malfet]

@Maratyszcza changed permissions to "Read repository contents and packages permissions"