Enable CodeQL Analysis of GitHub Actions workflows

Author: wilkinsona

.github/workflows/build-and-deploy-snapshot.yml

@@ -3,6 +3,8 @@ on:
   push:
     branches:
       - main
+permissions:
+  contents: read
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
 jobs:

.github/workflows/build-pull-request.yml

@@ -1,9 +1,7 @@
 name: Build Pull Request
 on: pull_request
-
 permissions:
   contents: read
-
 jobs:
   build:
     name: Build Pull Request

.github/workflows/ci.yml

@@ -3,6 +3,8 @@ on:
   push:
     branches:
       - main
+permissions:
+  contents: read
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
 jobs:

.github/workflows/release.yml

@@ -3,6 +3,8 @@ on:
   push:
     tags:
       - v0.0.[0-9]+
+permissions:
+  contents: read
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
 jobs:

.github/workflows/run-codeql-analysis.yml

@@ -0,0 +1,15 @@
+name: "Run CodeQL Analysis"
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+  schedule:
+    - cron: '45 0 * * 1'
+permissions: read-all
+jobs:
+  run-analysis:
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: spring-io/github-actions/.github/workflows/codeql-analysis.yml@6e66995f7d29de1e4ff76e4f0def7a10163fe910