Develop

.github/workflows/clang-format.yml

@@ -9,6 +9,9 @@ on: # yamllint disable-line rule:truthy
     branches: ["main"]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: clang-format style check

.github/workflows/codeql.yml

@@ -31,6 +31,9 @@ on: # yamllint disable-line rule:truthy
     #        *  * * * *
     - cron: "16 20 * * 0"
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})

.github/workflows/cpp-coverage.yml

@@ -9,6 +9,9 @@ on: # yamllint disable-line rule:truthy
     branches: ["main"]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   coverage:
     name: C/C++ CMake CI Coverage

.github/workflows/cpp-linux.yml

@@ -12,6 +12,9 @@ on: # yamllint disable-line rule:truthy
 env:
   VCPKG_VERSION: 2026.07.29
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: C/C++ CMake CI Test

.github/workflows/cpp-macos.yml

@@ -12,6 +12,9 @@ on: # yamllint disable-line rule:truthy
 env:
   VCPKG_VERSION: 2026.07.29
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: C/C++ CMake CI Test

.github/workflows/cpp-windows.yml

@@ -9,6 +9,9 @@ on: # yamllint disable-line rule:truthy
     branches: ["main"]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: C/C++ CMake CI Test

.github/workflows/cppcheck.yml

@@ -1,5 +1,4 @@
 ---
-
 name: CppCheck Lint
 
 on: # yamllint disable-line rule:truthy
@@ -10,6 +9,9 @@ on: # yamllint disable-line rule:truthy
     branches: ["main"]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: CppCheck Lint

.github/workflows/docker-image.yml

@@ -13,6 +13,9 @@ env:
   IMAGE_NAME: algorithm-exercises-cpp
   ARTIFACT_NAME: algorithm-exercises-cpp_${{ github.sha }}
 
+permissions:
+  contents: read
+
 jobs:
   setup:
     name: "Setup matrix"

.github/workflows/gitleaks.yml

@@ -1,5 +1,4 @@
 ---
-
 name: gitleaks
 
 on: # yamllint disable-line rule:truthy
@@ -17,6 +16,10 @@ on: # yamllint disable-line rule:truthy
     #        │  │ │ │ │
     #        *  * * * *
     - cron: "0 6 * * *" # run once a day at 6 AM
+
+permissions:
+  contents: read
+
 jobs:
   scan:
     name: gitleaks

.github/workflows/make-coverage-html.yml

@@ -12,6 +12,9 @@ on: # yamllint disable-line rule:truthy
     branches: ["main"]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   make-coverage-html:
     name: "Run make coverage/html and verify coverage HTML"

.github/workflows/prettier-json.yml

@@ -9,6 +9,9 @@ on: # yamllint disable-line rule:truthy
     branches: ["main"]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   json-lint:
     name: "Prettier JSON Lint"

.github/workflows/sonarcloud.yml

@@ -8,6 +8,9 @@ on: # yamllint disable-line rule:truthy
     types: [opened, synchronize, reopened]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: SonarCloud build and run sonar-scanner
@@ -22,17 +25,9 @@ jobs:
           fetch-depth: 0
       - name: Install Tools
         run: |
+          sudo apt-get install lcov
           sudo rm /usr/lib/python3.*/EXTERNALLY-MANAGED
-          pip install gcovr
-          #
-          # Install lcov dependencies
-          sudo apt-get install libcapture-tiny-perl libdatetime-perl
-          # Install lcov from source
-          git clone https://github.com/linux-test-project/lcov.git
-          cd lcov
-          git checkout v2.3.2
-          sudo make install
-          cd ..
+          pip install --only-binary :all: gcovr==8.6
 
       - name: Check Tools
         run: |

.github/workflows/yamllint.yml

@@ -9,6 +9,9 @@ on: # yamllint disable-line rule:truthy
     branches: ["main"]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: YAML lint