GH Actions: various tweaks

.github/workflows/reusable-validate.yml

@@ -3,18 +3,21 @@ name: Validate
 on:
   workflow_call:
 
+# Permissions should be configured at the job level.
 permissions: {}
 
 jobs:
   validate:
-    runs-on: ubuntu-latest
+    permissions:
+      contents: read # To clone the repo.
 
     strategy:
       fail-fast: true
       matrix:
         php: ['5.4', 'latest']
 
     name: PHP ${{ matrix.php }}
+    runs-on: ubuntu-latest
 
     steps:
       - name: Checkout code

.github/workflows/validate-cron.yml

@@ -5,11 +5,16 @@ on:
   schedule:
     - cron: '0 0 15 * *'
 
+# Permissions should be configured at the job level.
 permissions: {}
 
 jobs:
   validate:
+    permissions:
+      contents: read # To clone the repo.
+
     # Don't run the cron job on forks.
     if: ${{ github.event.repository.fork == false }}
 
+    name: Validate
     uses: ./.github/workflows/reusable-validate.yml

.github/workflows/validate.yml

@@ -7,8 +7,13 @@ on:
   # Allow manually triggering the workflow.
   workflow_dispatch:
 
+# Permissions should be configured at the job level.
 permissions: {}
 
 jobs:
   validate:
+    permissions:
+      contents: read # To clone the repo.
+
+    name: Validate
     uses: ./.github/workflows/reusable-validate.yml