Merge pull request MapServer#7001 from rouault/ci_concurrency_permiss…

…ions

CI .yml files: add 'concurrency' and 'permissions' group

.github/workflows/build-mapscript-php.yml

@@ -7,6 +7,13 @@ on:
     except:
       - /^(cherry-pick-)?backport-\d+-to-/
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-20.04

.github/workflows/build-mapscript-python.yml

@@ -7,6 +7,13 @@ on:
     except:
       - /^(cherry-pick-)?backport-\d+-to-/
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-20.04

.github/workflows/build.yml

@@ -2,6 +2,13 @@ name: Build
 
 on: [push, pull_request]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-20.04

.github/workflows/check-crlf.yml

@@ -5,6 +5,13 @@ name: Check CRLF
 
 on: [push, pull_request]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   Check-CRLF:
     name: verify that only LF linefeeds are used
@@ -17,4 +24,4 @@ jobs:
       - name: Use action to check for CRLF endings
         uses: erclu/[email protected]
         with: # ignore directories containing *.pdf and *.tab
-          exclude: msautotest/misc/data/ /msautotest/renderers/expected/
+          exclude: msautotest/misc/data/ /msautotest/renderers/expected/

.github/workflows/cifuzz.yml

@@ -1,5 +1,13 @@
 name: CIFuzz
 on: [pull_request]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   Fuzzing:
     runs-on: ubuntu-latest

.github/workflows/coverity-scan.yml

@@ -9,6 +9,13 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   build:

.github/workflows/cppcheck.yml

@@ -2,6 +2,13 @@ name: cppcheck
 
 on: [push, pull_request]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
 
   cppcheck_2004:

.github/workflows/irc_notify.yml

@@ -10,6 +10,13 @@ on:
     branches:
       - main
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   irc_notify:
     runs-on: ubuntu-latest